Cryptographic Connection Setup Using Prior Device Trust Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for initial security configuration setup on devices, particularly in industrial IoT and mobile radio devices, require complex manual interactions or centralized security infrastructures, making them laborious and limiting their applicability in flexible deployment scenarios.
Innovation Solution
A method for forming a cryptographically protected connection using device connection information and authentication information to establish a secure connection based on previous device interactions, allowing automated admissibility checks without explicit setup of authorization information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If automated admissibility checks are implemented during initial security configuration setup, then the amount of manual user interaction is reduced, but the complexity of the security infrastructure increases
Solution Approach 1:
The patent applies preliminary action by pre-provisioning security credentials and device connection information in the device before it needs to establish connections. This allows the device to perform automated admissibility checks without requiring complex centralized security infrastructure during the initial setup phase, thereby reducing manual user interaction while avoiding infrastructure complexity.
Solution Approach 2:
The device performs self-service by autonomously conducting admissibility checks using its own stored device connection information and authentication credentials. The device can independently verify its admissibility to connect to target devices without requiring external administrative intervention or complex centralized security management, thus reducing manual interaction while keeping the security infrastructure simple.
2Adaptability or versatility
If a centralized security infrastructure is used for admissibility checks, then security management is simplified, but the system becomes dependent on specific providers or PKI infrastructure
Solution Approach 1:
The patent implements universality by designing a security configuration that works across multiple deployment scenarios without requiring specific centralized security infrastructure. The device uses universal cryptographic protocols and stored credentials that enable it to perform admissibility checks independently, making the solution adaptable to different environments (industrial IoT, mobile radio, cloud services) without dependency on specific providers or PKI infrastructure.
Solution Approach 2:
The patent applies segmentation by separating the security verification functionality from centralized security infrastructure. Instead of relying on a centralized authority, the admissibility check capability is segmented and embedded directly in the device through pre-provisioned credentials. This allows the device to independently verify its admissibility without being tied to specific security infrastructure providers, enhancing adaptability while reducing infrastructure dependency.
3Reliability
If manual input of admissibility information is required during setup, then security strength is ensured, but the provisioning process becomes laborious
Solution Approach 1:
The patent applies preliminary action by pre-provisioning strong admissibility information (device connection information and authentication credentials) in the device during manufacturing or initial configuration. This eliminates the need for manual input during the provisioning process, maintaining security strength while significantly improving productivity by making the setup process automated and non-laborious.
Solution Approach 2:
The device performs self-service by automatically using its pre-stored authentication credentials to conduct admissibility checks. This eliminates the need for manual input of admissibility information while maintaining strong security, as the device autonomously presents its credentials and receives verification from target devices, thereby improving setup productivity without compromising reliability.
Data Source
AI summary
Various embodiments of the teachings herein include a method for forming a first cryptographically protected connection of a device to a unit. An example includes: transmitting a connection request from the device, wherein the connection request includes associated cryptographically protected device connection information and device authentication information, wherein the device connection information indicates a second connection of the device to a second device existed at an earlier time, wherein the device authentication information authenticates the device; checking the first device connection information and a second device connection information for a first match; checking the device connection information and the device authentication information for a second match; and forming the first cryptographically protected connection of the device to the unit based on the first match and the second match.