GBA Session Key Provisioning for Secure IoT Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The General Bootstrapping Architecture (GBA) faces challenges in securing communication links between Network Application Function (NAF) and Bootstrapping Server Function (BSF) when NAF is not in a secure zone, particularly due to the inefficiencies of asymmetric encryption in the context of IoT, which is slow and requires Public Key Infrastructure (PKI) systems that face scaling issues with millions of connected devices.
Innovation Solution
Implementing a method that provisions network nodes with a shared secret key for TLS-PSK encryption, using a pre-shared key (PSK) to establish a secure communication link between NAF and BSF without the need for public/private certificates, leveraging Subscriber Identity Module (SIM) or software SIM credentials to generate a GBA session key for a TLS-PSK tunnel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric encryption with certificates is used to secure the Zn interface between NAF and BSF, then security is provided, but processing speed is slow and scaling to millions of IoT devices is difficult
Solution Approach 1:
The patent changes the encryption parameter from asymmetric encryption (certificates) to symmetric encryption (pre-shared keys). This parameter change maintains security while dramatically improving processing speed and enabling scalable deployment to millions of IoT devices, as symmetric encryption is computationally less intensive and does not require complex certificate management infrastructure
Solution Approach 2:
The patent extracts the heavy certificate management infrastructure (PKI systems) from the authentication process and replaces it with a lightweight pre-shared key mechanism. This extraction removes the bottleneck that prevented scaling to IoT-scale deployments while maintaining the essential security function
2Reliability
If asymmetric encryption with certificates is used to secure the Zn interface, then security is provided, but infrastructure complexity increases due to PKI requirements
Solution Approach 1:
The patent extracts and removes the complex Public Key Infrastructure (PKI) system including certificate authorities, certificate validation, and key management infrastructure. It replaces this with a simple pre-shared key provisioning model that can be deployed without complex infrastructure, directly reducing device and infrastructure complexity
Solution Approach 2:
The patent replaces expensive, long-lived certificates with simpler, shorter-lived pre-shared keys that can be provisioned easily and rotated frequently. This substitution reduces infrastructure complexity and makes the system more adaptable to the dynamic nature of IoT deployments
3Reliability
If a Zn-Proxy node is added to communicate with BSF through untrusted network, then security is maintained, but device complexity increases and scalability is reduced
Solution Approach 1:
The patent extracts and removes the intermediate Zn-Proxy node from the architecture. By using pre-shared keys provisioned directly to NAF instances, the system eliminates the need for proxy nodes, directly reducing device complexity and enabling each NAF to communicate securely with BSF independently
Solution Approach 2:
The patent enables NAF instances to self-secure their communications with BSF using pre-provisioned keys. Each NAF instance independently establishes secure connections without requiring intermediary proxy nodes, reducing overall system complexity and improving scalability
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosure relates to methods and physical and virtual nodes for securing an interface and for securing a process for establishing a secure communication link between an Application Function located in an unsecure zone and an Authentication Function. In one embodiment, the method comprises the Application Function sending an authentication request message to the Authentication Function, receiving a response to the authentication request from the Authentication Function including an authentication challenge and sending a challenge response to the Authentication Function. The method comprises, upon receiving a response indicating success from the Authentication Function, the Application Function generating a session key using secret authentication credentials and information included in the authentication challenge and the Application Function handshaking with the Authentication Function and establishing the secure communication link using the session key, thereby securing the interface between the Application Function and the Authentication Function.