IoT Device Authentication via Distributed Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems for authenticating and securing communication channels between computing devices face challenges such as scalability issues with large numbers of devices, single points of failure, and the inability to enable two-device authentication without a third entity, particularly in IoT environments.
Innovation Solution
A method where two devices independently apply functions to randomly selected values to secure and authenticate a communication channel, using a polynomial-based approach where values are shared over different routes to prevent single-entity access, allowing for secure encryption key generation and authentication without relying on a third entity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a certificate authority or registration authority is used to authenticate devices, then security authentication can be established, but the system becomes difficult to scale and creates a single point of failure
Solution Approach 1:
The patent extracts the authentication capability from a centralized registration authority and embeds it directly into each device through pre-shared secrets. This eliminates the need for a central certificate authority while maintaining authentication security, allowing each device to independently verify others without creating a single point of failure.
Solution Approach 2:
The authentication system is segmented into distributed components where each device holds a portion of the authentication mechanism (pre-shared secrets). Instead of one centralized authority, multiple independent authentication nodes exist, improving both reliability and scalability.
2Reliability
If a registration authority processes authentication requests for all devices, then authentication can be performed, but the load on the authority increases as the number of devices grows
Solution Approach 1:
Devices perform authentication independently using pre-shared secrets without requiring a registration authority to process their authentication requests. This self-service approach eliminates the bottleneck at the central authority and allows unlimited devices to authenticate simultaneously, improving throughput while maintaining security.
3Reliability
If two devices authenticate each other using a third entity, then authentication can be established, but the system cannot enable direct two-device authentication
Solution Approach 1:
The authentication verification capability is extracted from the third entity and embedded into the communicating devices themselves. Each device can independently verify the other using pre-shared secrets, enabling direct authentication without requiring a mediating registration authority.
4Reliability
If encryption keys are shared between devices, then communication can be secured, but a hacker who obtains the key can decrypt encrypted data
Solution Approach 1:
The encryption key is segmented into multiple shares using secret sharing schemes. Each device holds only a portion of the key, and a threshold number of shares is required to reconstruct the full key. This prevents a single point of compromise while maintaining communication security.
Solution Approach 2:
Different portions of the encryption key are distributed to different devices based on their local needs and communication patterns. Each device has local knowledge of only the key shares it requires, reducing the attack surface while maintaining overall security.
Data Source
AI summary
A system and method for securing a communication channel may include obtaining a first value by first and second devices. A second value may be randomly selected by the first device and may be provided to the second device. The first and second devices may independently from one another apply a function to the first and second values and may use a result of the function to secure and authenticate a communication channel between the first and second devices.