Distributed IoT Authentication via Consensus and Key Exchange

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional single sign-on (SSO) services are inadequate for managing billions of IoT resources and serving millions of customers, especially when users access IoT resources from different domains, including public and private areas, and third-party applications, where the service provider lacks control over security.

Innovation Solution

Implementing distributed authentication in IoT networks by identifying access requests from trusted or untrusted nodes, using hash keys and proof of work to validate access requests, and establishing mutual trust through encrypted key exchanges for seamless access across various IoT resources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If traditional single sign-on services are used to manage IoT resources, then user authentication is simplified, but the system cannot scale to handle billions of IoT resources and millions of customers across multiple domains

Engineering Contradiction:

Improveability to manage billions of IoT resources across multiple domainsVSAvoidauthentication system complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent segments the centralized authentication system into distributed authentication nodes deployed across different domains. Each node independently handles authentication for local IoT resources, eliminating the single-point bottleneck and enabling horizontal scaling to billions of devices across multiple domains while maintaining manageable complexity at each node.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a new dimensional approach by implementing authentication across multiple domains (public, private, enterprise) simultaneously rather than through a single centralized point. This multi-dimensional authentication architecture allows the system to scale vertically across domains while keeping individual node complexity low.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

2Reliability

If centralized authentication control is implemented, then security management is simplified, but the service provider loses control over security in third-party applications and public domains

Engineering Contradiction:

Improvesecurity controlVSAvoidaccess control across public and private domains

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements local quality by allowing each authentication node to enforce security policies tailored to its specific domain (public, private, enterprise). Each node maintains security control locally while adapting to domain-specific requirements, ensuring both security reliability and domain adaptability without requiring centralized control.

Inventive Principle:

Principle #3Local quality

3Adaptability or versatility

If distributed authentication nodes are deployed across multiple domains, then access flexibility is improved, but the system cannot establish trust between nodes from different domains

Engineering Contradiction:

Improveaccess flexibility across domainsVSAvoidtrust establishment between nodes

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces domain identity tokens as intermediary credentials that enable trust establishment between authentication nodes from different domains. These tokens act as mediators, allowing nodes to verify each other's legitimacy without requiring direct trust relationships, thus enabling both access flexibility and reliable trust establishment across domain boundaries.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Reliability

If proof of work and consensus mechanisms are implemented for untrusted nodes, then security is enhanced, but the authentication process becomes more complex

Engineering Contradiction:

Improvesecurity validationVSAvoidauthentication process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies partial action by implementing proof of work and consensus mechanisms only for untrusted nodes, while trusted nodes use simpler authentication methods. This selective approach enhances security where needed without unnecessarily increasing complexity for all nodes, optimizing the balance between security and simplicity.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS10164983B2Distributed authentication for internet-of-things resources

Publication Date: 2018.12.25 VERIZON PATENT & LICENSING INC

AI summary

A network device receives, from a node in an Internet-of-Things (IoT) network, an access request for a user authenticated via the node and identifies the access request as from either of a trusted node or an untrusted node in the IoT network. When the access request is from an untrusted node, the network device identifies a hash key for the access request, wherein the hash key is derived from an access list for the IoT network; broadcasts the hash key to other trusted nodes in the IoT network; and validates the access request based on a solution consensus from the other trusted nodes. When the access request is from a trusted node, the network device confirms mutual trust with the trusted node via an encrypted key exchange, and validates the access request based on the mutual trust with the trusted node.