Home Hub Credential Sharing Across Mixed-TEE IoT Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT devices face security risks due to direct connection to the internet, and third-party control devices lack secure execution environments, leading to potential key credential cracking and unauthorized access.
Innovation Solution
Implement a method where devices with different trusted execution environments (TEE platforms) share identity credentials through secure channels, using PAKE and STS protocols to establish and verify identities, ensuring secure storage and elevated permissions for compatible devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If third-party control devices use the same identity credential as home hub devices, then compatibility and ease of operation are improved, but security is worsened due to potential key cracking on devices without secure execution environments
Solution Approach 1:
The identity credential is segmented into two parts: public key information stored in the home hub and private key information stored in the control device. This segmentation allows third-party devices to use the credential without exposing the entire key pair, maintaining security while enabling compatibility.
Solution Approach 2:
The private key information is extracted from the complete identity credential and stored separately in the control device's secure storage, while only the public key information remains in the home hub. This extraction eliminates the security risk of storing the full credential in devices without TEE protection.
2Ease of operation
If IoT devices are directly connected to the internet for easy control, then ease of operation is improved, but security is worsened due to exposure to public network attacks
Solution Approach 1:
The home hub acts as an intermediary between the control device and the IoT device. Control instructions are transmitted through the home hub rather than directly over the public network, isolating the IoT device from direct internet exposure while maintaining control functionality.
Solution Approach 2:
The network connection is segmented into two parts: the home hub connects to the public network for receiving control instructions, while the IoT device connects only to the home hub via local network. This segmentation protects the IoT device from direct internet attacks.
3Reliability
If a home hub is added to isolate IoT devices from the public network, then security is improved, but device complexity is worsened
Solution Approach 1:
The home hub is designed to perform multiple functions: it serves as a secure storage for public key information, a communication relay between control devices and IoT devices, and an authentication server. This multi-functionality justifies the added device by consolidating multiple security and control functions in one component.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
This application provides a control method, apparatus, and system, and is applied to the field of internet of things technologies. A first device and a home hub have a same TEE platform, and a second device and the home hub have different TEE platforms. The method includes: The home hub receives an identity credential of the second device and public key information of the first device that are sent by the second device. The home hub controls an IoT device based on the identity credential of the second device. The home hub receives private key information that is of the first device and that is sent by the first device. The home hub forms an identity credential of the first device based on the public key information of the first device and the private key information of the first device, to control the IoT device. In this application, the second device configures a set of identity credential in the home hub, so that the second device is bound to the home hub and controls the IoT device through the home hub. When the first device is subsequently connected to the home hub, another set of identity credential is configured in the home hub, so that the first device controls the IoT device through the home hub.