Edge Device Cluster Trust Using Pre-Provisioned Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized cloud computing systems are inadequate for managing IoT devices that are geographically distant or in disconnected regions, leading to latency issues and inability to meet time-sensitive data processing requirements, especially when establishing secure communication channels between edge devices.
Innovation Solution
A distributed computing system with a fleet of edge devices configured by a CSP, using a master encryption key and public encryption keys to establish trust and secure communication within the cluster without reliance on external networks, enabling secure integration and authentication of new devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If centralized cloud computing systems are used to manage IoT devices, then data processing and storage can be performed by service providers, but latency issues occur when devices are geographically distant and time-sensitive requirements cannot be met
Solution Approach 1:
The patent segments the centralized cloud computing system into distributed edge computing nodes deployed at geographic locations near IoT devices. Each edge device can independently process data locally, eliminating the need for long-distance data transmission to centralized servers and thereby reducing latency for time-sensitive operations.
Solution Approach 2:
The patent introduces a new dimensional approach by deploying edge computing infrastructure at the network edge (geographic dimension) rather than relying solely on centralized cloud data centers. This spatial redistribution enables data processing to occur closer to the source, reducing transmission distance and improving processing speed for remote IoT devices.
2Adaptability or versatility
If edge devices are deployed in disconnected regions without Internet connectivity, then local data processing can occur, but secure communication channels cannot be established with centralized cloud services
Solution Approach 1:
The patent applies preliminary action by pre-provisioning edge devices with cryptographic credentials (certificates and keys) before deployment to disconnected regions. This enables the devices to establish secure peer-to-peer communication channels with each other independently, without requiring real-time connection to centralized cloud services for authentication.
Solution Approach 2:
The patent introduces a trust intermediary mechanism where a designated edge device in the cluster acts as a local trust anchor, storing and managing cryptographic credentials that enable secure communication between all devices in the cluster. This local intermediary eliminates the need for continuous external cloud service connection while maintaining security.
3Productivity
If new edge devices are added to a fleet, then cluster capacity increases, but manual configuration and trust establishment becomes more complex
Solution Approach 1:
The patent implements self-service automation where new edge devices automatically obtain cryptographic credentials and establish trust relationships with existing cluster members without manual configuration. The devices autonomously register with the fleet, receive necessary security credentials, and integrate into the secure communication network, eliminating complex manual setup procedures.
Solution Approach 2:
The patent applies preliminary action by pre-configuring a standardized trust establishment protocol and credential distribution mechanism in the fleet management system. This enables automated, consistent provisioning of new devices with appropriate security credentials, reducing configuration complexity and enabling rapid cluster expansion.
Data Source
AI summary
Techniques are disclosed to establish trust in a cluster of edge devices. An edge device cloud service can associate a first cloud-computing edge device with a fleet of cloud-computing edge devices and provision the first cloud-computing edge device with a master encryption key. The edge device cloud service can associate a second cloud-computing edge device with the fleet and provision the second cloud-computing edge device with the master encryption key and the first public encryption key. The first cloud-computing edge device can receive from the second cloud-computing edge device encrypted message data comprising the second public encryption key. The first cloud-computing edge device can decrypt the encrypted message data using the master encryption key stored in the first key store and update the first key store with the second public encryption key.