IoT Access Control via Intermediary Token Relay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices with intermittent or indirect Internet connections pose challenges for traditional access control methods, as they require reliable and direct network connections for authentication and authorization, which are not always feasible, especially for devices like smart water meters in non-TCP/IP mesh networks.
Innovation Solution
The system allows IoT devices to send a token over a non-TCP/IP link to a requesting device, which then forwards it to an authorization server via a TCP/IP network for access control determination, eliminating the need for the IoT device to maintain a reliable Internet connection and reducing processing power and bandwidth requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control methods are used for IoT devices, then authentication and authorization can be performed reliably, but the IoT device must maintain a reliable and direct network connection to the authorization server
Solution Approach 1:
The patent introduces a requesting device as an intermediary between the IoT device and the authorization server. The IoT device communicates with the requesting device over a non-TCP/IP link (such as Bluetooth), and the requesting device handles the TCP/IP communication with the authorization server. This intermediary approach allows the IoT device to authenticate without maintaining a direct reliable network connection to the server.
Solution Approach 2:
The system segments the authentication process into two parts: (1) IoT device to requesting device communication over non-TCP/IP link for identifier exchange, and (2) requesting device to authorization server communication over TCP/IP network for authorization. This segmentation allows each component to use appropriate communication protocols, improving adaptability while maintaining reliability.
2Reliability
If IoT devices directly communicate with authorization servers over TCP/IP networks, then access control can be enforced, but processing power and bandwidth requirements increase
Solution Approach 1:
The requesting device acts as a mediator that handles the computationally intensive tasks of communicating with the authorization server, including TCP/IP protocol processing and authorization protocol implementation. The IoT device only needs to perform simple identifier exchange over Bluetooth, significantly reducing its processing power and energy consumption while maintaining access control enforcement.
3Reliability
If access control lists are continuously updated for IoT devices, then security is maintained, but system complexity and update requirements increase
Solution Approach 1:
The system performs preliminary authorization by obtaining authorization tokens in advance through the requesting device before the IoT device needs to perform actions. These pre-obtained authorizations are stored and used when needed, eliminating the need for continuous real-time updates of access control lists and reducing system complexity while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Requesting, by a requesting device, from an Internet of Things (IoT) device, an IoT device identifier over a communication link between the devcies. Requesting, by the requesting device from an authorization device over a communication network including at least one TCP/IP link, authorization to command the IoT device to perform an action. Determining, by the authorization device, an authorization of the requesting device to command the identified IoT device to perform the requested action based on the IoT device identifier, the requesting device identifier, and the command. For a requesting device determined authorized, transmitting an encrypted authorization to the requesting device over the communication network. Relaying, by the requesting device to the IoT device via the first communication link, the authorization. Decrypting, by the IoT device, the authorization and performing the action specified therein.