Dynamic Secure Channel Setup via Issued Protocol Specifications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for setting up secure communication channels between network devices, such as IoT devices, face challenges in dynamically updating protocol specifications to accommodate rapid developments in security protocols, particularly in ensuring secure data exchange.
Innovation Solution
A method involving an issuer device generating security data as a JSON web token with protocol specifications, which is transmitted during a TLS handshake or an initial provisional protocol, allowing the server to authenticate and determine the secure protocol, such as TLS 1.2, for establishing a secure communication channel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If protocol settings are defined during initial setup of network equipment, then device complexity is reduced and ease of operation is improved, but adaptability deteriorates due to inability to update protocols dynamically
Solution Approach 1:
The patent introduces a separate module called 'module for establishing a secure communication channel' that acts as an intermediary between the network device and external security protocols. This module can be updated independently of the core network device, allowing protocol updates without modifying the main device architecture. The module receives security data from an external issuing facility and uses it to establish secure communication channels, thereby enabling adaptability while keeping the main device simple.
Solution Approach 2:
The system is divided into distinct functional components: the core network device, the secure communication channel establishment module, and the external issuing facility. The protocol specification data and security data are separated from the main device functionality and stored externally. This segmentation allows the protocol layer to be updated independently through new security data issuance without affecting the core network device structure.
2Reliability
If security protocols are updated rapidly to accommodate new security requirements, then security reliability is improved, but device complexity increases due to multiple protocol versions
Solution Approach 1:
The patent implements a dynamic protocol selection mechanism where the network device can adaptively choose between different security protocols based on current security requirements and the issuing facility's specifications. The module determines which secure protocol to use (e.g., TLS 1.2, TLS 1.3) based on the received security data and protocol specification data, allowing the system to dynamically adjust to new security standards without permanently storing multiple protocol versions.
Solution Approach 2:
The system changes the protocol parameters dynamically by receiving new security data that contains updated protocol specifications. When new security requirements emerge, the issuing facility generates new security data with updated protocol parameters, and the network device's module adjusts its behavior accordingly. This allows security reliability to improve through parameter updates without requiring the device to maintain complex multi-version protocol stacks.
3Adaptability or versatility
If protocol specification data is stored in network devices, then adaptability is improved, but loss of information increases due to security risks of storing sensitive data
Solution Approach 1:
The patent extracts the sensitive protocol specification data and security data from the network device and stores it externally at the issuing facility. The network device only retains minimal operational data and receives security data on-demand when establishing secure communication channels. This extraction eliminates the security risk of storing sensitive protocol data in network devices while maintaining adaptability through external data availability.
4Adaptability or versatility
If TLS protocol is extended to include security data transmission, then adaptability is improved, but device complexity increases due to protocol modifications
Solution Approach 1:
The patent makes the secure communication channel establishment module universal by designing it to work with multiple different security protocols (TLS 1.2, TLS 1.3, and future protocols). The module uses a standardized interface for receiving security data and protocol specification data from the external issuing facility, allowing it to adapt to different protocols without requiring separate implementation for each protocol version. This multi-functionality approach enables security data integration while avoiding the need to modify the core TLS protocol implementation in each network device.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method for establishing a secure communication channel (3) for exchanging data between a first and second network device (1, 2) via a secure protocol (4) is proposed. The second network device (2) is configured to define the secure protocol (4) based on protocol specification data, which specifies the prerequisites for the secure protocol (4). This method comprises: generating (S1) security data by an issuing device (5), wherein the security data defines the protocol specification data; transmitting (S2) the security data to the first network device (1) from the issuing device (5); and transmitting (S3) the security data to the second network device (2) from the first network device (1). The protocol specification data enables the dynamic specification of a secure protocol for a secure communication channel between the first and second network devices.In particular, the permitted protocol options of the second network device can be adjusted.