IoT Authentication Server SIM Credential Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT authentication methods for network devices with SIM-cards face challenges such as secure key storage and PIN entry, which are complex and costly to implement, especially for mass commissioning of small devices without input interfaces.
Innovation Solution
An IoT-authentication server that stores a dataset linking SIM-card unique identifications with specific credentials, allowing for authentication by matching candidate credentials with those linked to the SIM-card and verifying the network device's unique identification through the public communication network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Pre-Shared Keys are deposited on IoT devices during production, then authentication security is improved, but device complexity and manufacturing cost increase
Solution Approach 1:
The patent extracts the key storage function from the IoT device itself and relocates it to the SIM card. The SIM card stores the credentials that were previously needed on the device, thereby reducing device complexity while maintaining authentication security. The device no longer needs to store keys locally, as they are kept secure on the SIM card and used only during authentication.
Solution Approach 2:
The SIM card acts as an intermediary between the authentication server and the IoT device. It holds the credentials and participates in the authentication process without requiring the device to store sensitive key material. This mediator approach resolves the contradiction by providing secure key management through a dedicated component rather than embedding complexity in the device.
2Reliability
If PIN entry is enabled on SIM-cards for security, then security is improved, but ease of operation deteriorates for mass commissioning of small devices without input interfaces
Solution Approach 1:
The patent segments the authentication process into two parts: security verification (handled by the SIM card credentials) and device identification (handled by the device ID exchange). This segmentation allows the system to maintain security through SIM card credentials while eliminating the need for PIN entry on devices without input interfaces, as the device ID can be automatically exchanged and verified.
Solution Approach 2:
Instead of requiring PIN entry on the device, the system uses a copied identifier approach where the device ID is exchanged between the device and server, and this ID is then used to retrieve the corresponding SIM card credentials from the authentication server. This copying mechanism maintains security while enabling automated commissioning of headless devices.
3Ease of operation
If device-ID based authentication is used, then ease of operation is improved, but security level is limited to the confidentiality of the device-ID
Solution Approach 1:
The patent merges device-ID based authentication with SIM card credential verification into a unified authentication process. The device ID is used to identify the device and retrieve corresponding credentials, but the actual authentication is performed using secure SIM card credentials rather than relying solely on device ID confidentiality. This combination maintains operational simplicity while significantly enhancing security.
Solution Approach 2:
The patent adds another dimension to authentication by moving from single-factor device ID verification to a two-layer approach: device ID matching followed by SIM card credential verification. This dimensional addition transforms the security model from relying on device ID confidentiality to using cryptographic credentials stored on secure SIM cards, thereby enhancing security while maintaining the simplicity of automated authentication.
Data Source
Figure 1
Figure 2
AI summary
The present invention relates to an loT-authentication server (101) for authentication of a network device (107) with a SIM-card (105), the loT-authentication server (101) comprising: - a processor (121) configured to: - store a dataset (119) linking a unique identification (111) of the SIM-card (105) and a given set of specific credentials in a memory (123) of the loT-authentication server (101), - receive an authentication request comprising a candidate unique identification (117) of the network device (107) and a candidate set of credentials (115); - retrieve a unique identification (113) of the network device (107) specified in a network layer of a public communication network transmitting the authentication request; and - generate an authentication-label (125) for labelling the network device (107) as authenticated only in case the unique identification (113) of the network device (107) specified in the network layer of the public communication network transmitting the authentication request matches the candidate unique identification (117) of the network device (107) specified in the authentication request, and the candidate set of credentials (115) transmitted to the loT-authentication server (101) from the network device (107) using the SIM-card (105) matches the specific credentials linked with the unique identification (111) of the SIM-card (105) in the dataset (119).