Gateway Authentication Credential Binding for Resource-Constrained Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Resource-constrained client devices in capillary networks face challenges in securely connecting to application servers due to their inability to handle or store 3GPP credentials, which are typically required for authentication.
Innovation Solution
A gateway is introduced to establish and manage authentication credentials using an authentication server, relieving the client device of this task and ensuring secure communication by binding credentials to the client device's identity, even if the device lacks secure storage capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client devices use 3GPP credentials for authentication, then secure communication with application servers is achieved, but resource-constrained devices cannot store or handle credentials securely
Solution Approach 1:
The gateway acts as an intermediary between the authentication server and resource-constrained client devices. It retrieves authentication credentials from the authentication server on behalf of client devices and forwards them to application servers, eliminating the need for client devices to store or handle credentials directly. This resolves the contradiction by maintaining authentication security through the gateway's mediation while accommodating the limited capabilities of resource-constrained devices.
2Ease of operation
If client devices store authentication credentials, then authentication can be performed independently, but secure storage cannot be guaranteed on resource-constrained devices
Solution Approach 1:
The authentication credential storage and management functions are extracted from resource-constrained client devices and relocated to the gateway. The gateway retrieves credentials from the authentication server and handles them centrally, allowing client devices to perform authentication operations without possessing actual credentials. This extraction resolves the contradiction by enabling authentication functionality while removing the security risk of storing credentials on insecure devices.
3Productivity
If multiple client devices share the same gateway, then resource utilization is improved, but individual device authentication becomes more complex
Solution Approach 1:
The gateway implements a universal authentication mechanism that serves multiple client devices through a single interface. It maintains authentication credentials centrally and can authenticate any connected client device using the same credential retrieval process. This multi-functional approach resolves the contradiction by allowing high gateway utilization while keeping individual device authentication simple and uniform.
Data Source
Figure 1A~2
Figure 3~4
Figure 5
AI summary
According to a first aspect, it is presented a method, executed in a gateway, the gateway being arranged to facilitate communication between a client device and an application server. The method comprises the steps of: receiving a client request from the client device, the client request comprising at least a portion being bound for the application server; sending an application server request to the application server; receiving an application server response from the application server, the application server response indicating a need to provide authentication; establishing at least one authentication credential using an authentication server for a connection between the client device and the application server; and sending a client response to the client device, the client response being based on the application server response and comprising the at least one authentication credential. An associated gateway, client device, vehicle, computer program and computer program product are also presented.