IoT Access Control via Dynamic Token Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Access-controlled devices in IoT settings face challenges in securely managing access tokens, particularly in scenarios where a compromised credential could lead to permanent unauthorized access, and existing solutions require a distinct communication capability towards a gateway.
Innovation Solution
An apparatus and method that store encryption keys and lists of access tokens, selecting and using these tokens based on current time or sequence number to grant access, allowing access-controlled devices to receive new tokens from user devices, eliminating the need for a fixed connection to a gateway.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access tokens are changed periodically to enhance security, then security against compromised credentials is improved, but device complexity increases due to time-based or sequence-based token selection mechanisms
Solution Approach 1:
The access control system dynamically selects access tokens based on current time or sequence numbers rather than using static tokens. The apparatus stores multiple access tokens with associated validity periods or sequence ranges, and automatically selects the appropriate token based on current conditions, making the system adaptive and secure against compromised credentials.
Solution Approach 2:
The system pre-stores multiple access tokens along with their validity information (time periods or sequence number ranges) in the apparatus. This preliminary preparation eliminates the need for real-time token generation or complex cryptographic operations during access attempts, reducing computational complexity while maintaining security.
2Adaptability or versatility
If access controlled devices request new credentials via a fixed gateway, then credential refresh capability is improved, but device complexity increases due to dedicated gateway communication infrastructure
Solution Approach 1:
The patent extracts the gateway communication function from the access controlled device itself. Instead of embedding a dedicated gateway interface in each device, the system uses existing communication paths (such as user devices already connected to the gateway) to transfer access tokens to the apparatus, eliminating the need for separate gateway infrastructure.
Solution Approach 2:
The system uses user devices that already have gateway connectivity for multiple purposes: both for control operations and for credential refresh. The same communication interface used for normal device operation is also utilized to receive new access tokens from the gateway through the user device, reducing overall system complexity.
3Device complexity
If static credentials are used for access control, then device complexity is reduced, but security deteriorates as compromised credentials provide permanent unauthorized access
Solution Approach 1:
The system implements periodic credential rotation where access tokens are automatically updated after specific time periods or after a certain number of uses (sequence numbers). The apparatus stores multiple tokens and transitions between them based on elapsed time or usage count, ensuring that even if one token is compromised, its validity is limited to a specific period or usage range.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to an example aspect of the present invention, there is provided an apparatus comprising a memory configured to store an encryption key and a list of access tokens and at least one processing core configured to select a first access token from the list of access tokens based, at least partly, on at least one of a current time and a sequence number, decide, based at least partly on the first access token, whether to grant a user device access to the apparatus, and cause the apparatus to receive a second list of access tokens from at least one of the user device and a second user device.