IoT API Access Control via Gateway Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for interconnecting IoT devices to the Internet require pre-configuration, making it burdensome to add new devices to a private network without manual configuration, and pose security risks as each device creates a potential access point for nefarious users.
Innovation Solution
A system that exposes APIs of IoT devices to a public network instead of IP addresses and port numbers, using a control service with an access list to manage and authorize access, allowing system-agnostic IoT devices to join a private network seamlessly and securely without manual configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration is used to add IoT devices to a private network, then device security can be controlled, but the complexity and burden of configuration increases significantly
Solution Approach 1:
The system enables self-service configuration where IoT devices automatically join the private network without manual user intervention. The gateway device automatically discovers new devices, retrieves their API information, and configures access control lists without requiring user configuration commands, thus eliminating configuration complexity while maintaining security through automated API-level access control
Solution Approach 2:
The system changes the configuration parameter from IP address and port number to API endpoint. Instead of manually configuring network parameters for each device, the system automatically retrieves and stores API information (endpoint, method, parameters) in the access control list, enabling seamless device addition while maintaining security through API-level authorization
2Ease of operation
If each IoT device is exposed to the public network, then device accessibility is improved, but security risks increase due to additional access points
Solution Approach 1:
The system introduces an intermediary layer (gateway device with access control list) between the public network and IoT devices. Instead of directly exposing devices to the public network, all requests must pass through the gateway which checks API authorization in the access control list, thus maintaining accessibility while mitigating security risks through controlled intermediary access
Solution Approach 2:
The system segments network access at the API level rather than allowing direct device exposure. Each API endpoint is individually managed in the access control list, enabling fine-grained security control where specific APIs can be authorized or denied independently, thus reducing the impact of any single access point while maintaining overall system accessibility
3Reliability
If pre-configuration is required for IoT devices, then network security is maintained, but the ease of adding new devices deteriorates
Solution Approach 1:
The system performs preliminary action by automatically retrieving and storing API information for all IoT devices in the access control list before they need to access the network. When a device is added, the gateway automatically discovers its APIs and pre-configures access control entries, eliminating the need for manual pre-configuration while maintaining security through automated API-level authorization
Data Source
AI summary
The disclosure relates to using a control service to control external access to APIs of IoT devices on a private network. An external application can request access to an API, and in response, the control service can monitor broadcasts from the IoT devices indicating what APIs they have available. If a match exists, the control service can request user authorization to allow the requested access. The user can grant or deny the requested access, and place limitations on the authorized access. The control service uses this information to open a connection between the requesting application and the IoT device having the requested API, and via this connection, the requesting application can access and control the device running the requested API.