IoT Data Encrypt-Decrypt-Once Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT security solutions fail to encrypt IoT data consistently throughout its lifecycle, leaving it vulnerable between transmission and storage stages, leading to potential attacks and increased computational burdens.
Innovation Solution
Implementing an 'encrypt-decrypt-once' technology that encrypts IoT data only once at its inception and keeps it encrypted until final consumption, using a public key certificate-based scheme, salted challenge response authentication, DiffieHellman key-exchange, and authenticated encryption with AES-GCM mode, reducing the need for intermediate encryption/decryption cycles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted multiple times during transmission and storage stages, then data security is improved, but computational burden and processing time increase
Solution Approach 1:
The patent applies preliminary action by establishing end-to-end encryption at the data source (IoT device) before transmission begins. The device encrypts data using its unique decryption key derived from a shared secret, so that data is already protected before entering the network. This eliminates the need for multiple intermediate encryption/decryption cycles at gateways and servers, reducing processing time while maintaining security throughout the data lifecycle.
2Ease of operation
If data is decrypted at intermediate stages (gateway, server), then data processing capability is improved, but data exposure to attacks increases
Solution Approach 1:
The patent applies segmentation by dividing the encryption key into two parts: a shared secret known to both the IoT device and the server, and a unique decryption key stored only at the server. The device uses the shared secret to encrypt data locally, while the server uses both the shared secret and the unique key to decrypt. This segmentation allows the server to process data without exposing it to attacks during transmission, as the data remains encrypted end-to-end.
3Reliability
If multiple encryption/decryption cycles are implemented, then data security coverage is improved, but device complexity increases
Solution Approach 1:
The patent applies merging by combining the encryption and decryption operations into a single end-to-end encryption mechanism. Instead of implementing multiple separate encryption/decryption cycles at different stages (device encryption, gateway encryption, server encryption), the system merges these into one unified approach where the IoT device encrypts data using its unique key, and the server decrypts it using the corresponding key. This reduces system complexity while maintaining comprehensive security coverage.
Data Source
AI summary
Techniques are disclosed for encrypting internet-of-things (IoT) data of an IoT network only once at its inception until its final consumption without intervening encryption/decryption stages/cycles. The present encrypt-decrypt-once design thus eliminates potential exposure of the IoT data in its plaintext form of a traditional approach employing intervening encryption/decryption cycles. The present design is also efficient and reduces the burden on IoT resources by eliminating the need for encrypting and decrypting the data multiple times. To accomplish these objectives, a number of schemes for device enrollment, authentication, key distribution, key derivation, encryption and encoding are disclosed. The devices employ authenticated encryption because it provides confidentiality, integrity, and authenticity assurances on the encrypted data. The final consumption of the IoT data may be at a designated gateway or a corporate system.