IoT Device Access Authorization via Paired User Equipment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing devices, such as IoT devices, often lack effective access control mechanisms, allowing unauthorized users to connect and access services, compromising privacy and security.
Innovation Solution
Implementing a system that uses a registry server for authentication and offline key management, where user equipment is paired with devices via Bluetooth, ensuring proper encryption and verification through a Challenge-Handshake Authentication Protocol (CHAP) exchange, allowing secure access to limited services even without a network connection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If any user equipment is allowed to connect and use services, then ease of operation is improved, but security and privacy are compromised
Solution Approach 1:
The system performs preliminary authentication actions before allowing service access. User equipment must be paired with the device and receive authorization confirmation from a registry server before gaining access to services. This preliminary authorization step ensures that only authenticated users can connect and use services, resolving the contradiction between ease of connection and security.
2Object-affected harmful factors
If online authentication via registry server is implemented, then security is improved, but energy consumption increases
Solution Approach 1:
The system performs authentication preliminarily by pairing user equipment with the device and obtaining authorization confirmation from the registry server in advance. Once paired, the device can authenticate offline using stored credentials, eliminating the need for continuous online authentication. This preliminary action reduces energy consumption while maintaining security.
Solution Approach 2:
The device performs self-authentication using offline credentials stored locally after initial pairing. The device can verify user equipment authenticity without requiring continuous communication with the registry server, enabling energy-efficient autonomous authentication while maintaining security standards.
3Use of energy by moving object
If offline authentication is implemented, then energy efficiency is improved, but authentication reliability may be compromised
Solution Approach 1:
The system establishes trusted credentials through preliminary online authentication with the registry server before offline operation. User equipment is paired with the device and receives authorization confirmation that is stored locally. This preliminary action ensures that offline authentication uses verified credentials, maintaining reliability while enabling energy-efficient operation.
Solution Approach 2:
The registry server acts as an intermediary that initially verifies and authorizes the pairing between device and user equipment. The authorization confirmation from the registry server serves as a trusted intermediary credential that the device can verify offline, ensuring authentication reliability without continuous server connection.
Data Source
AI summary
Device access authorization via connected user equipment is performed with a device including a controller, a memory in communication with the controller, the memory storing a device identifier, a registration service, and a limited access service, and a secure element in communication with the controller, the secure element storing a device authentication key and a registry certificate. The controller includes circuitry configured to transmit an authorization request to the user equipment, the authorization request including a request for authorization from a registry server, the device identifier, the user identifier, and the registry server challenge, receive an authorization response from the user equipment, the authorization response including an authorization confirmation and a registry server signature, verify the registry server signature using the registry certificate, and notify the user equipment of a limited access service in response to receiving the authorization confirmation and successfully verifying the registry server signature.