IoT Client Certificate Authentication via Hash Cache
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices face challenges in secure communication due to limited resources and the need for reduced calculation and traffic data usage, especially with large numbers of devices, where traditional client certificate-based authentication methods are inefficient.
Innovation Solution
Implementing a handshake process that reduces the frequency of transmitting client certificates by utilizing a cache system to store hash values of client and server certificates, allowing for cache hits to minimize data transfer and computation, and optimizing cache control to improve hit rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client certificate is transmitted in every handshake for device authentication, then authentication security is ensured, but traffic data amount increases and calculation resources are consumed
Solution Approach 1:
The patent segments the authentication process into two parts: transmitting only the hash value of the client certificate in the handshake, and transmitting the full client certificate separately through a different channel (e.g., pre-shared or out-of-band). This segmentation allows the handshake to use minimal data while maintaining security through hash verification.
Solution Approach 2:
The patent uses a hash value (a cryptographic copy or representation) of the client certificate instead of the full certificate in the handshake. This hash copy is sufficient for verification purposes during connection establishment, reducing traffic data while maintaining authentication security.
2Reliability
If client certificate is transmitted in every handshake for device authentication, then authentication security is ensured, but calculation resources are consumed
Solution Approach 1:
The patent segments the computational workload by performing hash verification during the handshake (which is computationally lighter) and handling the full certificate verification separately when needed. This segmentation reduces the calculation burden during frequent connection establishment operations.
Solution Approach 2:
The patent uses hash values as computational proxies for the full client certificate during handshake verification. Computing and verifying hashes requires significantly fewer calculation resources than processing full certificates, thereby reducing energy consumption while maintaining security.
3Reliability
If client certificate is transmitted in every handshake for device authentication, then authentication is performed, but the frequency of transmission cannot be reduced
Solution Approach 1:
The patent separates the authentication verification into two stages: a lightweight hash verification during handshake for rapid connection establishment, and optional full certificate verification for enhanced security when needed. This segmentation enables frequent connections with reduced overhead.
Solution Approach 2:
The patent uses hash values as efficient substitutes for full certificate transmission during handshake. This copying approach maintains authentication capability while dramatically reducing transmission frequency and improving connection establishment efficiency.
Data Source
AI summary
When a client certificate is required to connect to a client according to a predetermined communication protocol, a server receives a connection request that is a message associated with specific information from the client in a handshake for connection with the client. The server makes a client judgement as to whether or not a cache hit occurs, which is to find a summary client certificate in a cache area using the specific information associated with the connection request. When the result of the client judgement is true, the server returns to the client a connection response including hit information indicating that a cache hit occurs.