IoT Device Authentication via Certificate Version Numbers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Public Key Infrastructure (PKI) architectures for device authentication in IoT scenarios are inefficient due to high communication costs and low authentication speed, especially when managing device certificates and key exchanges within trusted groups.
Innovation Solution
A method and system where a server generates and updates certificates and version numbers for devices joining or leaving a trusted group, allowing terminals to authenticate by comparing version numbers, thereby reducing the need for frequent key exchanges and improving authentication efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a device exchanges keys by using a key exchange protocol each time authentication is performed, then security is maintained, but communication costs are high and authentication efficiency is low
Solution Approach 1:
The patent applies preliminary action by pre-generating authentication certificates with embedded version numbers before authentication is needed. The server generates certificates in advance that contain version information, allowing devices to perform quick version comparison for authentication without executing full key exchange protocols each time. This pre-computation approach significantly reduces authentication overhead while maintaining security through the version-based validation mechanism.
2Measurement precision
If a trust center maintains a removing list and devices query it each time, then device removal is tracked accurately, but communication overhead increases and authentication speed decreases
Solution Approach 1:
The patent merges the removal list functionality directly into the authentication certificate itself. Instead of maintaining a separate removing list that requires querying, the server embeds version number information in each certificate that automatically reflects the current trusted device set. When a device is removed, the server issues new certificates with updated version numbers to remaining devices, eliminating the need for separate removal list queries and reducing authentication time.
3Reliability
If public key certificates are issued and validated through traditional PKI, then identity authentication is performed, but communication costs are high and there are large quantities of rounds
Solution Approach 1:
The patent extracts the essential authentication verification element (version number) from the complex traditional PKI certificate validation process. Instead of requiring full certificate chain validation and multiple protocol rounds, the invention extracts and embeds version numbers directly in certificates, allowing devices to perform simple version comparison for authentication. This extraction maintains identity validation accuracy while dramatically simplifying the authentication protocol and reducing communication rounds.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of this application disclose an identity authentication method. The method includes: when receiving a group joining request that is sent by a first terminal and that is used for joining a trusted group, generating, by a server, a first certificate for the first terminal based on a first version number, and sending, by the server, the first certificate and the first version number to the first terminal; when determining that a second terminal is removed from the trusted group, updating, by the server, the first version number to a second version number according to a preset rule; separately generating, by the server based on the second version number, a corresponding second certificate for a terminal not removed from the trusted group; and separately sending, by the server, the corresponding second certificate and the second version number to the terminal not removed from the trusted group. In this way, during authentication, a terminal may compare a version number of the other party to perform identity authentication, thereby improving authentication efficiency.