IoT Device Identity Authentication Using Bidirectional Encrypted Code Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Internet of Things (IoT) device identity authentication methods face challenges due to limited computing capabilities and resource constraints, leading to excessive resource consumption and vulnerability to attacks, as they often rely on static information or complex algorithms that are difficult to implement on IoT devices.
Innovation Solution
A bidirectional authentication method where a client device and server device exchange authentication codes generated using preset encryption algorithms, with the client device performing initial authentication and sending a processed authentication code and encrypted data packet to the server, which then performs reciprocal authentication, eliminating the need for multiple recursive iterations and public or private keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complex encryption algorithms are used for identity authentication, then security is improved, but resource consumption increases and device complexity increases
Solution Approach 1:
The authentication process is divided into two independent phases: client authentication to server and server authentication to client. Each phase uses simple symmetric encryption algorithms independently, avoiding the need for complex bidirectional authentication protocols. This segmentation allows IoT devices to perform authentication without consuming excessive resources.
Solution Approach 2:
Instead of requiring the IoT device to perform complex cryptographic operations to prove its identity, the server performs authentication operations. The client simply sends its identifier and receives an encrypted authentication code, reversing the traditional role of computational burden.
2Reliability
If complex encryption algorithms are used for identity authentication, then security is improved, but device complexity increases
Solution Approach 1:
The authentication protocol is segmented into simple sequential steps: client sends identifier, server generates encrypted code, client sends code back, server verifies and authenticates. This segmentation avoids complex multi-phase authentication protocols while maintaining security through the encryption of authentication codes.
Solution Approach 2:
The patent uses temporary encrypted authentication codes that are discarded after use, rather than requiring complex long-term cryptographic key management systems. These disposable authentication codes simplify device complexity while providing secure temporary authentication.
3Device complexity
If static authentication data is used, then device complexity is reduced, but security deteriorates due to vulnerability to attacks
Solution Approach 1:
The authentication system transitions from static authentication data to dynamic encrypted authentication codes. The server generates new encrypted authentication codes for each authentication attempt, making the authentication process dynamic and resistant to replay attacks, while maintaining simple device implementation.
Solution Approach 2:
The system changes the parameter of authentication data from static to dynamic encrypted codes. The authentication code is encrypted using the current time and a shared key, changing the authentication mechanism from static verification to dynamic cryptographic verification, thereby improving security without increasing device complexity.
4Reliability
If bidirectional authentication is implemented, then security is improved, but authentication time increases
Solution Approach 1:
The bidirectional authentication is segmented into two independent parallel processes: client authenticates to server and server authenticates to client simultaneously. Both processes use simple encrypted code verification rather than complex mutual challenge-response protocols, reducing the time required for bidirectional authentication while maintaining security.
Solution Approach 2:
The server creates a copy of the authentication code encrypted with the shared key and sends it to the client. This copying approach allows both parties to verify each other's identity using simple encryption/decryption operations rather than complex cryptographic challenges, reducing authentication time.
Data Source
AI summary
Disclosed are an Internet-of-Things device identity authentication method, apparatus and system, and a storage medium. The method includes: sending an identity authentication request so that a server device generates a first authentication code; receiving the first authentication code, generating a second authentication code, and determining that an identity of the server device is valid when the first and second authentication code are consistent; encrypting the first authentication code to generate a third authentication code; and sending the third authentication code and a preconfigured encrypted data packet to the server device, so that the server device decrypts the third authentication code to generate a fourth authentication code, decrypts the encrypted data packet to obtain device authentication information when the first and fourth authentication code are consistent, and determines that an identity of a client device is valid when the device authentication information is consistent with device-specific information of the client device.