IoT Device Bootstrap Identifier Provisioning for Secure Connectivity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Devices in IoT networks face challenges in maintaining secure communications due to IP address changes, requiring frequent re-provisioning of security certificates, which is inconvenient and costly.
Innovation Solution
A method and system for establishing a communication path between devices using a bootstrap device to provision necessary identifiers and connection data, allowing devices to securely connect without relying on static IP addresses, using a security object with resources like server identifiers and reachability resources to validate connections independently of name resolution services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If devices use IP addresses in security certificates for communication, then devices can establish initial connections, but re-provisioning is required when IP addresses change
Solution Approach 1:
The patent segments the identifier system into multiple types: IP addresses for initial connection, FQDNs for addressing, and certificate identifiers for validation. This segmentation allows each identifier type to serve its specific purpose without requiring updates to all identifiers when network conditions change.
Solution Approach 2:
The patent introduces name resolution services (DNS, LDAPS) as intermediaries that translate between stable identifiers (FQDNs, certificate identifiers) and dynamic identifiers (IP addresses). This intermediary layer absorbs the changes, preventing the need for re-provisioning security certificates.
2Reliability
If devices rely on static IP addresses for secure communication, then initial connection is established, but frequent re-provisioning of certificates is needed when IP addresses change
Solution Approach 1:
The patent separates the security validation mechanism from the addressing mechanism. Security certificates contain identifiers that are independent of IP addresses, allowing security validation to remain simple while addressing can adapt to network changes.
Solution Approach 2:
Name resolution services act as intermediaries that handle the complexity of mapping stable identifiers to dynamic IP addresses, shielding devices from certificate management complexity while maintaining secure communication.
3Ease of operation
If devices use IP address-based security certificates, then connections can be established, but costs and time are incurred for re-provisioning
Solution Approach 1:
The patent performs preliminary actions by provisioning devices with multiple identifier types (IP address, FQDN, certificate identifier) in advance. This preliminary configuration enables the device to adapt to network changes without time-consuming re-provisioning operations.
Solution Approach 2:
The patent implements a dynamic identifier resolution process where the device can switch between different identifier types based on network conditions. This dynamic approach maintains ease of operation while eliminating the need for frequent re-provisioning.
4Adaptability or versatility
If devices depend on name resolution services for communication, then flexible addressing is achieved, but connectivity is lost when name resolution is unavailable
Solution Approach 1:
The patent applies different identifier types in different contexts: IP addresses for direct local communication where name resolution may not be available, and FQDNs/certificate identifiers for remote communication where name resolution services are accessible. This local quality approach ensures connectivity in both scenarios.
Solution Approach 2:
The patent creates a composite addressing system that combines multiple identifier types (IP addresses, FQDNs, certificate identifiers) into a unified communication framework. This composite approach provides both the flexibility of name resolution and the reliability of direct IP-based communication.
Data Source
AI summary
A method of establishing a communications path between devices comprising: receiving, at a first device, data, the data comprising: a first resource having a first identifier for a second device remote from the first device; a second resource having a second identifier for the second device; addressing the second device with the first identifier; generating, at the first device, first connection data based on the second identifier; transmitting, from the first device to the second device, the first connection data; receiving, at the first device, second connection data; validating, at the first device, the second connection data; establishing the communications path between the first device and second device responsive to valid second connection data.