Zero Trust DAO Validation in RPL Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing proposals for securing RPL networks in low-power and lossy networks fail to provide a scalable solution against unauthorized access, as they rely on computation-intensive encryption techniques and shared cryptographic keys, which are not suitable for constrained devices and do not ensure 'zero trust' security.
Innovation Solution
The implementation of a method that selectively issues a cryptographic challenge to a Destination Advertisement Object (DAO) message, validating whether the advertising network device owns a secure token associated with the target IP address, without encrypting the target IP address and without relying on shared cryptographic keys, using secure tokens generated with private cryptographic keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If computation-intensive encryption techniques are used to secure RPL networks, then security is improved, but processing overhead and energy consumption increase beyond what constrained devices can handle
Solution Approach 1:
The patent extracts the cryptographic validation burden from the advertising device and places it on the parent network device. The advertising device only needs to generate and include a secure token in the DAO message, while the parent device performs the computationally intensive validation by issuing cryptographic challenges and verifying responses. This extraction allows constrained advertising devices to maintain security without excessive processing overhead.
Solution Approach 2:
The patent introduces an intermediary cryptographic challenge-response mechanism between the advertising device and parent device. Instead of direct encryption of all DAO messages, the system uses secure tokens as intermediaries that can be validated through challenge-response protocols. This intermediary approach provides strong security validation while keeping the actual cryptographic operations localized to when challenges are issued, rather than continuously encrypting all traffic.
2Reliability
If shared cryptographic keys are used for securing RPL networks, then security is improved, but the system becomes vulnerable if keys are compromised and lacks zero trust security
Solution Approach 1:
The patent segments the cryptographic validation into device-specific secure tokens rather than network-wide shared keys. Each advertising device generates its own secure token based on its private cryptographic key, creating isolated security boundaries. This segmentation means that compromise of one device's key does not affect other devices, enabling zero trust security where each device is independently validated without relying on shared network credentials.
3Reliability
If encryption is applied to target IP addresses in DAO messages, then security is improved, but processing overhead and message size increase
Solution Approach 1:
The patent uses secure tokens as cryptographic copies or representations of the advertising device's identity and ownership, rather than directly encrypting the target IP address. The secure token serves as a verifiable credential that proves authorization without requiring the actual IP address to be encrypted. This copying approach maintains IP address visibility for routing purposes while providing cryptographic proof of authorization through the token validation process.
Data Source
AI summary
In one embodiment, a method comprises: receiving, by a parent network device providing at least a portion of a directed acyclic graph (DAG) according to a prescribed routing protocol in a low power and lossy network, a destination advertisement object (DAO) message, the DAO message specifying a target Internet Protocol (IP) address claimed by an advertising network device in the DAG and the DAO message further specifying a secure token associated with the target IP address; and selectively issuing a cryptographic challenge to the DAO message to validate whether the advertising network device generated the secure token.