Identity-Based Key Pre-Distribution for IoT Certificate Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic systems using X.509 certificates are inefficient due to large size and high computational requirements, making them unsuitable for resource-constrained networks like IoT and sensor networks, where communication overhead must be minimized.
Innovation Solution
A cryptographic system that allows implicit certification and verification through identity-based key pre-distribution schemes, where network nodes receive local key material generated by applying an algorithm to a root key material and identifier, eliminating the need for explicit signature verification and enabling authentication through active message exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If X.509 certificates are used for secure communication, then authentication and security are provided, but certificate size becomes large and communication overhead increases
Solution Approach 1:
The patent segments the certificate verification process into two parts: (1) a small certificate containing only the public key and identifier, and (2) a separate signature verification process. This segmentation reduces the certificate size from typical X.509 certificates (1KB for 1024-bit RSA) to a minimal structure, while maintaining security through the separate signature verification mechanism.
Solution Approach 2:
The patent extracts the signature from the certificate structure itself, allowing the certificate to contain only essential elements (public key and identifier). The signature verification is performed separately using the certificate authority's public key, which eliminates the need to embed large signature data within the certificate, thereby reducing certificate size while preserving authentication capability.
2Reliability
If X.509 certificates with digital signatures are used, then certificate authenticity is verified, but computational complexity and processing time increase
Solution Approach 1:
The patent employs lightweight cryptographic algorithms that are computationally inexpensive compared to traditional RSA or ECC signatures. The system uses simplified signature schemes that can be verified with minimal computational resources, making them suitable for low-power devices such as IoT sensors and embedded systems where full-strength cryptographic operations are prohibitively expensive.
3Reliability
If traditional certificate verification is used, then security is maintained, but communication overhead and processing time increase
Solution Approach 1:
The patent performs signature verification as a separate, dedicated step that can be optimized independently of the main communication flow. By pre-establishing the certificate authority's public key and using efficient verification algorithms, the system minimizes the time required for verification, allowing faster authentication compared to traditional embedded signature verification in X.509 certificates.
Data Source
AI summary
A cryptographic system (100) is provided for distributing certificates comprising a certificate authority device (110) and multiple network nodes (140, 150, 160). A network node (140) sends a public key to the certificate authority device. The certificate authority device (110) generate a certificate comprising the public key, forms an identifier by applying an identity forming function to the certificate and generates local key material specific for the network node by applying a local key material generation algorithm of an identity based key pre-distribution scheme on the identifier, and sends the local key material encrypted to the network node. The network node may be authenticated implicitly through its access to a shared key obtainable from the local key material.