IoT Service Certificate Chain via Network Management Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT devices face security risks due to the use of insecure or universally preset service certificates, which can compromise the entire network if a device is compromised, and the use of unique device certificates increases production complexity and cost.
Innovation Solution
A device certificate authenticated by a server is preset in a network management device, allowing it to issue service certificates to lower-layer devices, forming a secure certificate chain without directly presetting certificates in those devices, ensuring service security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a vendor presets a unified service certificate in all devices, then device production complexity is reduced, but network security is compromised because all devices share the same certificate
Solution Approach 1:
The patent segments the certificate system into two distinct components: device certificates (presed during manufacturing for device identification) and service certificates (dynamically allocated for specific services). This segmentation allows unified device certification while enabling individualized service-level security, resolving the contradiction between manufacturing simplicity and security.
Solution Approach 2:
The patent introduces a network operator server as an intermediary that issues service certificates to devices based on their device certificates. This intermediary enables dynamic service certificate allocation without increasing manufacturing complexity, as the devices only need to preset generic device certificates while the server handles service-specific certification.
2Reliability
If a vendor presets a unique service certificate in each device, then network security is improved, but device production complexity and costs increase
Solution Approach 1:
The patent separates device identification (handled by preset device certificates) from service authentication (handled by dynamically allocated service certificates). Devices only need to preset simple device certificates during manufacturing, while service certificates are obtained dynamically from the network operator server, reducing production complexity while maintaining security.
Solution Approach 2:
The patent enables devices to autonomously obtain service certificates from the network operator server using their preset device certificates. This self-service mechanism eliminates the need for manual certificate configuration during device production, reducing manufacturing complexity while ensuring each device has unique service credentials.
3Ease of manufacture
If no service certificate is preset in devices, then production complexity is reduced, but security risks arise without a certificate chain
Solution Approach 1:
The patent implements preliminary action by having devices preset device certificates during manufacturing (without service certificates), and then performing preliminary authentication with the network operator server to obtain service certificates before accessing network services. This ensures security credentials are in place before service deployment without complicating manufacturing.
Solution Approach 2:
The network operator server acts as an intermediary that bridges devices and the network by issuing service certificates based on device certificate verification. This intermediary enables a complete certificate chain (device certificate → service certificate → network access) without requiring service certificates to be preset in devices, maintaining both security and manufacturing simplicity.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
This application provides a method, an apparatus, and a system for service certificate management, and an electronic device, and relates to the field of information security technologies. In this method, a device certificate authenticated by a server is preset in a network management device, so that the network management device may issue a service certificate to a lower-layer device of the network management device by using the device certificate, thereby forming a secure and effective certificate chain between the server, the network management device, and the lower-layer device of the network management device, avoiding presetting a service certificate in the lower-layer device of the network management device, and ensuring service security of the lower-layer device of the network management device.