Cryptographically Generated Device Identifiers for Privacy and Stability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device identifiers such as MAC addresses and IMEI numbers raise privacy concerns and are no longer suitable for stable device identification due to privacy concerns and support for MAC address rotation, necessitating a new method for device ownership assertion and network validation.
Innovation Solution
The implementation of Cryptographically Generated Device Identifiers (CGDI) using cryptographic techniques, which generates identifiers that are unique to the device, immutable within a network, and access-agnostic, ensuring privacy and consistent security policies across sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Stability of the object's composition
If existing identifiers (MAC address, IMEI) are used for device identification, then device identification stability is improved, but privacy protection deteriorates
Solution Approach 1:
The patent creates a copy of the device identifier through cryptographic hashing. The CGDI is generated by hashing the MAC address and combining it with network-specific information, creating a new identifier that preserves stability while eliminating direct exposure of the original MAC address. This copying principle allows the network to identify devices without accessing sensitive personal information.
Solution Approach 2:
The patent introduces a cryptographic hash function as an intermediary between the MAC address and the network identifier. This intermediary transforms the stable but privacy-exposing MAC address into a CGDI that maintains identification stability while preventing direct privacy exposure. The hash function acts as a mediator that preserves the linking relationship without exposing the original data.
2Object-affected harmful factors
If MAC address rotation is supported for privacy protection, then privacy protection is improved, but device identification stability deteriorates
Solution Approach 1:
The patent makes the device identifier dynamic by incorporating network-specific information into the CGDI generation process. The identifier changes based on the network context while maintaining stability within a specific network. This dynamic approach allows the system to adapt to MAC address rotation while preserving identification stability through cryptographic binding of network-specific data.
Solution Approach 2:
The patent changes the parameters used in identifier generation by incorporating network-specific information (such as network identifier, timestamp, or random value) into the cryptographic hash. This parameter change allows the identifier to remain stable for a given network while enabling flexibility across different networks, resolving the contradiction between stability and adaptability.
3Object-affected harmful factors
If cryptographically generated device identifiers are used, then privacy protection is improved, but device complexity increases
Solution Approach 1:
The patent extracts the cryptographic operations from the device side and places them in the network side. The CGDI is generated by the network using the device's MAC address and network-specific information, rather than requiring the device to perform complex cryptographic operations. This extraction reduces device complexity while maintaining privacy protection.
Solution Approach 2:
The patent makes the network infrastructure universal by using existing network components (authentication server, access point) to perform the cryptographic operations. The same network infrastructure that handles authentication also generates the CGDI, eliminating the need for separate complex identifier generation systems and reducing overall device complexity.
Data Source
AI summary
Techniques for network communications are disclosed. These techniques include receiving a cryptographically generated device identifier (CGDI) and a public key relating to a wireless station (STA). The techniques further include determining a first hash based on decrypting the CGDI using the public key, and validating the first hash for an access network. The techniques further include identifying the STA in the access network using the CGDI based on binding the CGDI to a session associated with the STA and the access network.