Data Provisioning Device for Secure IoT Entity Setup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In IoT systems, the increasing number of data processing entities to be provisioned often lacks a direct, secure connection to the provisioning data source, necessitating a more flexible approach for data provisioning.
Innovation Solution
A distributed provisioning approach using a separate data provisioning device that receives provisioning data from a remote source, processes it with a joint encryption key, and transmits encrypted data to data processing entities, allowing for secure, indirect communication and eliminating the need for a direct connection between the provisioning source and entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a direct secure connection is established between provisioning data source and data processing entities, then security is improved, but device complexity and operational flexibility deteriorate due to the requirement of direct connections for each entity
Solution Approach 1:
A data provisioning device is introduced as an intermediary between the provisioning data source and multiple data processing entities. This intermediary receives provisioning data from the source, processes it using a joint encryption key, and distributes encrypted provisioning data to multiple entities simultaneously, eliminating the need for direct connections between the source and each entity while maintaining security through cryptographic protection
2Reliability
If direct connections are provided for each data processing entity, then security is improved, but ease of operation deteriorates due to the inability to provision entities in unsecured environments
Solution Approach 1:
The data provisioning device serves as a mediator that enables provisioning operations in unsecured environments by consolidating the security functions. Instead of requiring each entity to have a direct secure connection to the source, the intermediary performs secure processing and distribution, allowing entities to be provisioned remotely without physical security requirements
Solution Approach 2:
The data provisioning device performs multiple functions: receiving provisioning data from the source, processing data for multiple different entities using the joint encryption key, encrypting the provisioning data, and distributing it to various entities. This multi-functional approach replaces multiple individual secure connections with a single versatile provisioning device
3Reliability
If direct secure connections are established, then security is improved, but adaptability deteriorates due to the rigid requirement of direct connections
Solution Approach 1:
The intermediary data provisioning device decouples the provisioning source from the target entities, enabling flexible deployment scenarios. The device can provision entities that are physically separated, remotely located, or in unsecured environments, while the source remains unchanged. This intermediary approach provides adaptability without compromising the security of the provisioning data
Solution Approach 2:
The provisioning system is segmented into distinct functional components: the provisioning data source, the data provisioning device with processing and encryption capabilities, and the target data processing entities. This segmentation allows each component to operate independently with defined interfaces, improving system adaptability and flexibility while maintaining security through the cryptographic processing in the intermediary device
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
The disclosure relates to a data provisioning device (100) for provisioning a data processing entity (102-1) from a set of data processing entities (103) sharing the same joint decryption key, the data provisioning device (100) comprising: a network interface (105), the network interface (105) being configured to receive the provisioning data for provisioning the data processing entity (102-1), a joint encryption key (107) being associated with the joint encryption key, and control information, the control information indicating a processing scheme to be deployed by the data provisioning device (100) when provisioning the provisioning data device (102-1); a processor (107) being configured to process the provisioning data according to the control information to obtain processed provisioning data, to cryptographically encrypt the processed provisioning data using the received joint encryption key to obtain encrypted processed provisioning data; and a device interface (109) being configured to transmit the encrypted processed provisioning data to the data processing entity (102-1).