IoT Access Authorization via Intermediary Whitelist Rules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IoT devices often lack secure methods for allowing external network access without centralized subscription servers, leading to vulnerabilities as users may inadvertently expose their home networks by opening ports and using default credentials, making them susceptible to hacker access.
Innovation Solution
Implementing a system where access requests from external networks are authorized through a hardware processor, which determines if a rule applies, sends requests for authorization to an administrator device via an authorization server, and blocks or allows access based on user-defined rules, adding IP addresses to a whitelist or blacklist as necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If port forwarding is configured on home gateway to allow external access to IoT devices, then remote accessibility is improved, but network security deteriorates due to exposure to hackers
Solution Approach 1:
The patent introduces an authorization server as an intermediary between external access requests and IoT devices. The server receives requests, validates them against whitelist rules, and only permits authorized connections. This mediator layer maintains remote accessibility while blocking unauthorized access attempts, resolving the security vulnerability of direct port forwarding.
Solution Approach 2:
The system performs preliminary authorization checks before allowing external access to IoT devices. IP addresses are added to a whitelist in advance, and the authorization server validates incoming requests against this pre-configured list. This preliminary validation prevents unauthorized connections before they can reach the devices, addressing the security risk while maintaining accessibility.
2Ease of manufacture
If default username and password are used on gateway after port forwarding setup, then ease of configuration is improved, but security deteriorates due to susceptibility to hacker access
Solution Approach 1:
The authorization server acts as an intermediary authentication layer that compensates for weak gateway credentials. Even if default passwords are used, the server's whitelist-based authorization mechanism prevents unauthorized access by blocking requests from non-whitelisted IP addresses, thus maintaining configuration simplicity while improving security.
3Adaptability or versatility
If centralized subscription server is not used for IoT device access, then device independence and user control are improved, but security management deteriorates due to lack of centralized authorization
Solution Approach 1:
The system enables self-service security management by allowing users to configure their own whitelist of authorized IP addresses through a mobile application. Users independently manage access control for their IoT devices without requiring a centralized subscription server, thus maintaining device independence while implementing effective security management through user-configured authorization rules.
Data Source
AI summary
Mechanisms for authorizing requests to access a resource are provided, the methods comprising: receiving a request to access the resource at a hardware processor from an Internet Protocol (IP) address; determining whether a rule applies to the request to access the resource; in response to determining that a rule does not apply to the request to access the resource, sending a request for authorization; receiving a response to the request for authorization; and in response to the response to the request for authorization indicating that access is authorized, providing a connection to the resource.