Bootstrapping Resource-Constrained IoT Devices via Proxy Gateway

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Resource-constrained M2M devices face challenges in securely bootstrapping with authorized gateways and managing connectivity, especially when they do not support full HTTP/TCP stacks, and securely discovering gateways in large-scale IoT ecosystems with multiple players and adversaries.

Innovation Solution

A method and architecture that uses a pre-established trust relationship between devices and network-based entities, involving an access gateway and bootstrapping server to securely authenticate and authorize devices using 3GPP credentials, allowing for non-HTTP protocols and secure connection establishment, even in constrained environments.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If full HTTP/TCP stacks are implemented in M2M devices, then secure bootstrapping and connectivity management are enabled, but device complexity and resource consumption increase

Engineering Contradiction:

Improvesecure bootstrappingVSAvoidHTTP/TCP stack

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the essential bootstrapping functionality from the full HTTP/TCP stack. The M2M device only implements minimal bootstrapping client functionality to establish initial security credentials, while the gateway handles the complex HTTP/TCP communication and full stack implementation. This separation allows secure bootstrapping without requiring the constrained device to carry the complete protocol stack.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The gateway acts as an intermediary between the resource-constrained M2M device and the network. The device communicates simplified messages through the gateway, which then handles the complex HTTP/TCP protocol interactions with the bootstrapping server. This mediator approach enables secure bootstrapping for constrained devices without requiring them to implement full protocol stacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If 3GPP credentials are used in M2M devices, then secure authentication is achieved, but device cost and complexity increase

Engineering Contradiction:

Improveauthentication securityVSAvoidcredential management

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies partial action by implementing only the essential 3GPP authentication mechanisms needed for secure bootstrapping, rather than full credential management. The device stores minimal credential information (such as a shared secret or simplified identity) and relies on the gateway and network infrastructure to handle the complete authentication protocol, thus achieving security without full credential management complexity.

Inventive Principle:

Principle #16Partial or excessive action

3Productivity

If centralized device management is implemented, then scalability to large numbers of devices is achieved, but network traffic and management overhead increase

Engineering Contradiction:

Improvedevice management scalabilityVSAvoidnetwork traffic

Core Design Contradiction:

ProductivityVSLoss of energy

Solution Approach 1:

The patent applies preliminary action by establishing security credentials and authentication mechanisms during the initial bootstrapping phase. Once devices are bootstrapped with security credentials, they can communicate more efficiently with the management server using established secure channels. The bootstrapping process prepares devices in advance with the necessary security context to minimize ongoing network traffic for authentication and authorization.

Inventive Principle:

Principle #10Preliminary action

4Reliability

If secure gateway discovery is implemented in large-scale IoT ecosystems, then device security is improved, but bootstrapping complexity and time increase

Engineering Contradiction:

Improvegateway authenticationVSAvoidbootstrapping time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies self-service by enabling devices to autonomously discover and authenticate with authorized gateways using pre-configured security credentials. The device independently performs gateway discovery and authentication without requiring manual configuration or complex centralized coordination, thus achieving secure gateway discovery while minimizing bootstrapping time through automated credential verification.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS10601815B2Methods and devices for bootstrapping of resource constrained devices

Publication Date: 2020.03.24 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

It is disclosed a method of establishing a secure connection between a device and a network-based entity, NAF, via an access gateway, where the device and a network-based bootstrapping server, BSF, have a pre-established trust relationship. The method comprises the access gateway acting as a proxy between the device and the BSF. A reference to a NAF received from the BSF is used to securely authenticate the device to the NAF. An identity of the access gateway is sent to the NAF and the identity is used to authorise the device to use the access gateway. The access gateway identity is authenticated at the BSF and/or the NAF. The access gateway may relay messages to the device over a non-HTTP link.