Edge Device Sensor Data Access Control via Authorization Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In edge computing scenarios, there is a need for secure control of access to sensor data, especially when edge devices are remote from the security platform, as conventional security methods may not ensure secure connections, compromising data security.
Innovation Solution
A system that deploys an authorization token on edge devices, defining which sensor data they can access and operations they can perform, using secret keys for encryption and decryption, allowing only authorized devices to access and modify sensor data by providing specific keys for permitted operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If edge devices are separated significantly from the security platform due to air gap in edge computing, then data processing can occur locally at devices, but secure connection and network between edge device and security platform may not exist
Solution Approach 1:
The system performs preliminary actions by pre-installing and pre-configuring the authorization token and encryption keys on edge devices before they operate in isolated environments. The security platform generates and distributes authorization tokens containing access control data and encryption keys in advance, enabling devices to securely access sensor data without requiring continuous secure connections to the security platform during operation.
Solution Approach 2:
The authorization token acts as an intermediary carrier that bridges the gap between the security platform and edge devices. It encapsulates access control data and encryption keys, allowing devices to prove their authorization status and retrieve necessary cryptographic material without establishing direct secure connections to the security platform, thus resolving the connectivity reliability issue while maintaining local processing capability.
2Ease of operation
If sensor data is stored on edge devices for local access, then data availability improves, but data security may be compromised without proper protection mechanisms
Solution Approach 1:
The system applies local quality by implementing data protection mechanisms directly at the edge device where data is stored and processed. Each device encrypts sensor data using keys derived from its authorization token, ensuring that data remains secure locally without requiring continuous communication with the security platform. This localized security approach maintains data availability while preventing unauthorized access.
Solution Approach 2:
Edge devices perform self-service security operations by using their own authorization tokens and embedded keys to encrypt, decrypt, and protect sensor data independently. The devices autonomously manage their cryptographic material and access control without requiring external intervention from the security platform, thereby maintaining both data availability and security in isolated environments.
3Adaptability or versatility
If access control data is deployed on edge devices, then no physical connection with security platform is needed, but device complexity increases due to additional security components
Solution Approach 1:
The system merges multiple security functions into a single integrated authorization token structure. The token combines access control data, device identification information, and encryption key references into one unified cryptographic object. This consolidation allows devices to perform remote access control without requiring separate modules for authentication, authorization, and key management, thereby reducing overall system complexity while maintaining adaptability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of controlling access to sensor data includes of: generating sensor data, and protecting the sensor data to generate protected sensor data; and transmitting the protected sensor data to a device for storage; receiving, by the sensor: access control data defining one or more operations which the device is permitted to execute on the protected sensor data; determining by the sensor, based on the access control data, an operation which the device is permitted to execute on the protected sensor data; enabling the device to execute the permitted operation on the protected sensor data. A method of accessing protected sensor data by a device, the device having stored thereon access control data defining one or more operations which the device is permitted to execute on protected sensor data, includes the steps of: receiving protected sensor data from a sensor; storing the received protected sensor data; sending the authorization access control data to the sensor; and receiving, from the sensor, a signal enabling the device to execute a permitted operation on the protected sensor data.