IoT Agent Authentication via Segmented Key and ID Assignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The management of IoT agent devices becomes complex as the number of devices increases, and the security of data transfer is compromised if different authentication keys are used, while using identical keys risks security breaches if leaked.
Innovation Solution
An IoT data collection system where agent devices transmit an authentication activation key to a management device at startup, which collates it with a registered key to assign a unique authentication agent ID, ensuring secure data transfer and easy management by preventing illegal activation and leakage of the authentication agent ID, even if the agent ID is leaked.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If different authentication keys are assigned to each agent device, then security of data transfer is improved, but management complexity increases
Solution Approach 1:
The authentication system is segmented into two distinct components: authentication keys (for device identity) and agent IDs (for data transfer authentication). This segmentation allows different keys to be used for different purposes, improving security while simplifying management through role-based separation.
Solution Approach 2:
The server acts as an intermediary that manages the mapping between authentication keys and agent IDs. Instead of directly managing complex key distributions, the server mediates the authentication process by verifying keys and issuing corresponding agent IDs, thereby simplifying overall system management.
2Ease of operation
If identical authentication keys are assigned to multiple agent devices, then management becomes easier, but security is compromised if the key is leaked
Solution Approach 1:
By separating authentication key management from agent ID usage, the system allows multiple devices to share the same authentication key for simplified management, while the unique agent IDs ensure that even if one key is compromised, only the specific agent ID associated with it is affected, not all devices.
Solution Approach 2:
Each agent device is assigned a unique agent ID that is locally valid for its specific data transfer operations. This local quality ensures that compromise of one device's credentials does not affect other devices, even if they share authentication keys.
3Device complexity
If authentication keys are used for both device activation and data transfer, then system simplicity is improved, but security risk increases if the key is leaked
Solution Approach 1:
The system segments authentication functionality into two distinct mechanisms: authentication keys for device activation and agent IDs for data transfer. This segmentation reduces security risk by limiting the scope of each credential, while maintaining system simplicity through a unified authentication flow managed by the server.
Solution Approach 2:
The data transfer authentication capability is extracted from the device activation key and implemented as a separate agent ID. This extraction allows the activation key to be used solely for device registration, reducing its security exposure, while the agent ID handles data transfer authentication.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Provided is an IoT data collection system 100 including an agent device 10 configured to acquire IoT data, a management device 20 configured to manage the agent device 10, and a server device 30 configured to receive the IoT data from the agent device 10. The agent device 10 includes a first transmission unit configured to transmit an authentication activation key to the management device 20 at startup. The management device 20 includes a collation unit configured to collate a registered activation key and the authentication activation key, and a transmission unit configured to transmit an authentication agent ID to the agent device 10 when the collation result is matched. The agent device 10 further includes a second transmission unit configured to transmit the IoT data and the authentication agent ID to the server device 30. The server device 30 includes a collation unit configured to collate a registered agent ID and the authentication agent ID, and a reception unit configured to receive the IoT data from the agent device 10 when the collation result is matched.