Device Commissioning with Dual-Level Authentication Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems face challenges in integrating and managing diverse authentication mechanisms for devices and services, particularly in converged IP-networks with technologies like 5G, TSN, and OPC UA, leading to fragmented security functions and inefficient device commissioning processes.
Innovation Solution
A method involving dual authentication levels - network-level and application-level - is implemented, where a network core unit authenticates devices initially, followed by a device-managing unit authenticating them on an application level, with a network-managing unit configuring isolated logical connectivity between devices, ensuring secure and efficient integration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple authentication mechanisms are integrated for devices and services in converged IP-networks, then security is improved, but system complexity increases
Solution Approach 1:
The patent segments the authentication process into distinct hierarchical levels: network-level authentication (5G, TSN) and application-level authentication (OPC UA). Each level operates independently with its own authentication mechanisms, allowing security to be strengthened without requiring all mechanisms to work simultaneously, thus managing complexity through modular segmentation of security functions.
Solution Approach 2:
The patent introduces intermediary components including a network-managing unit and device-managing unit that act as mediators between different authentication systems. These intermediaries handle the coordination between network-level and application-level authentication, translating and bridging different security protocols without requiring direct integration between all authentication mechanisms.
2Ease of operation
If security functions are consolidated in one system, then management is simplified, but adaptability to different standards and vendors is reduced
Solution Approach 1:
The patent implements a universal hierarchical authentication framework where the network-level authentication serves multiple functions: it provides base security for all devices regardless of vendor, enables application-level authentication for specific protocols, and maintains compatibility with various standards (5G, TSN, OPC UA) through standardized interfaces at each level.
Solution Approach 2:
The authentication system is designed dynamically where devices can progress through different authentication stages based on their specific requirements. The system adapts to different vendors and standards by allowing flexible configuration of authentication mechanisms at each level while maintaining a consistent overall framework, enabling the system to evolve as new standards emerge.
3Reliability
If comprehensive authentication is performed for all devices, then authentication confidence is improved, but processing time increases
Solution Approach 1:
The patent implements preliminary network-level authentication that occurs before application-level authentication. This preliminary authentication establishes a trusted base layer that validates devices at the network level, allowing subsequent application-level authentication to proceed more efficiently with reduced overhead, as the foundational trust relationship is already established.
Solution Approach 2:
The system applies partial authentication appropriately by performing full network-level authentication for all devices, then applying application-level authentication selectively based on specific protocol requirements and security needs. Not all devices require the complete authentication sequence, allowing optimization of processing time while maintaining necessary security confidence.
Data Source
AI summary
A network system with a network core unit, a network-managing unit, a device-managing unit, and a network data-infrastructure, and a method for admitting an application device in this network system, are disclosed. The method includes authenticating the application device on network-level, notifying the network-managing unit about an authenticating result, configuring the network data-infrastructure to provide a connectivity between the network-managing unit and the device-managing unit, performing an authenticating action for the application device for authenticating the access device on application-level, notifying the network-managing unit about the authentication result, and configuring the network data-infrastructure to provide an isolated logical network connectivity between the application device and other equally authenticated application devices.