Certificate-Verified Device Control Without VPN Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT and IIoT platforms face challenges in secure and efficient data transmission without the need for virtual private networks (VPNs), which are resource-intensive.
Innovation Solution
A method involving a communication device that verifies identifiers and encryption keys using certificates to ensure secure data transmission, allowing control commands to be sent directly without VPNs, utilizing cryptographic techniques like RSA and PKCS for encryption and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPNs are used for secure data transmission, then security is improved, but device complexity and resource consumption increase
Solution Approach 1:
The patent extracts the essential security function from the complex VPN infrastructure. Instead of implementing a full VPN protocol stack, the invention uses direct cryptographic operations (digital signatures with RSA/PKCS) to achieve authentication and data integrity without the overhead of VPN tunneling, routing, and encapsulation layers.
Solution Approach 2:
The patent replaces the mechanical VPN system (requiring VPN servers, clients, and protocol processing) with a cryptographic substitution approach. Digital signatures and public-key infrastructure (PKI) provide the same security guarantees through mathematical operations rather than network-layer encapsulation, reducing hardware and software complexity.
2Reliability
If VPNs are used for secure data transmission, then security is improved, but energy consumption increases
Solution Approach 1:
The invention extracts only the necessary cryptographic authentication functions from the VPN system. By using direct digital signature verification instead of full VPN protocol processing, the energy-intensive steps of tunnel establishment, packet encapsulation/decapsulation, and VPN key management are eliminated, retaining only the essential signature verification operation.
Solution Approach 2:
The patent employs ephemeral cryptographic sessions where each communication uses fresh random nonces and temporary key pairs for signature generation. This disposable approach to cryptographic materials avoids the sustained energy consumption of maintaining persistent VPN connections while providing equivalent security for each transaction.
3Reliability
If certificate verification and cryptographic operations are implemented, then security is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary certificate verification during device initialization or first connection. Once the sending device's certificate is validated and its public key is trusted, subsequent communications only require signature verification rather than full certificate chain validation, significantly reducing processing time for ongoing transactions.
Solution Approach 2:
The invention changes the cryptographic parameter from full certificate validation (which includes chain verification, revocation checking, and expiration validation) to simple signature verification using a pre-loaded public key. This parameter change maintains security for trusted devices while reducing computational complexity and processing time for each message.
Data Source
Figure 1~3
Figure 4~6
Figure 7~10
AI summary
The invention relates to a method for controlling a device (10), wherein: - a communication apparatus (12) is connected to the device (10); - in a step S1, the communication apparatus (12) receives a plain text and a signature from a transmitter apparatus (14); - in a step S2, the communication apparatus (12) verifies a first identifier (ID1), which is assigned to the transmitter apparatus (14), and a first encryption key (CS1) using a valid first certificate (Z1) and interrupts the method if the result of this verification is negative; - in a step S3, the communication apparatus (12) verifies the received signature and the received plain text using the first encryption key (CS1) and interrupts the method if the result of this verification is negative; - in a step S4, the communication apparatus (12) checks whether a control instruction for the device (10) is contained in the plain text, and interrupts the method if the result of this check is negative; - in a step S5, the communication apparatus (12) checks whether an authorisation for the control instruction is assigned to the first encryption key (CS1) and/or to the first identifier (ID1), and interrupts the method if the result of this check is negative; - in a step S6, the communication apparatus (12) generates a control command for the device (10) using the control instruction contained in the reproduced plain text; and - in a step S7, the communication apparatus (12) transmits the control command to the device (10), as a result of which the device (10) is controlled. This enables secure information and communication networking and data transfer between the transmitter apparatus (14) and the device (10).