IoT Device Authentication via Local Secret and Remote Random Value Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication protocols for IoT devices with limited hardware and energy resources, such as those using IPv4 addressing, face challenges in secure and efficient signaling due to resource constraints, which can lead to usability issues and vulnerabilities like replay attacks.
Innovation Solution
An apparatus and method that utilize a local-range channel for a secret value and a wireless base station channel for a random value to derive hash values for secure communication, allowing IoT devices to perform actions based on instructions without the need for cryptographic protocols like TLS, using channels like Bluetooth, WebSockets, or CoAP, thereby restricting access and preventing replay attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic protocols like TLS are used for secure communication, then security is improved, but computational resource usage and energy consumption increase
Solution Approach 1:
The patent extracts the essential security function (authentication and replay attack prevention) from the complex TLS cryptographic protocol, implementing a simplified custom protocol that achieves the same security goals with minimal computational overhead suitable for constrained IoT devices
Solution Approach 2:
The patent changes the cryptographic parameters by using lightweight hash functions (MD5, SHA-1) instead of full TLS cryptographic suites, and implements a simplified key exchange mechanism using random values and challenge-response authentication, reducing computational complexity while maintaining security
2Reliability
If full cryptographic protocols are implemented, then security is improved, but device complexity increases
Solution Approach 1:
The patent extracts only the necessary security components (authentication, replay attack prevention) from the complete TLS protocol suite, implementing a streamlined custom protocol that maintains security essentials while eliminating unnecessary complexity for IoT devices with limited resources
Solution Approach 2:
Instead of implementing a reduced version of TLS, the patent inverts the approach by designing a completely new simplified protocol from scratch that achieves the same security objectives with fundamentally simpler mechanisms tailored for constrained devices
3Adaptability or versatility
If standard IP addressing is used, then network connectivity is improved, but security against replay attacks worsens
Solution Approach 1:
The patent implements preliminary action by establishing secure authentication and generating random values before actual data transmission, using challenge-response mechanisms that prevent replay attacks by ensuring each communication session is uniquely authenticated in advance
Solution Approach 2:
The patent introduces an intermediary authentication mechanism using random values and hash-based challenge-response protocols that mediate between the communicating parties, verifying identities and preventing replay attacks without compromising the underlying IP network connectivity
4Reliability
If local-range channels are used for secret value transmission, then security is improved, but communication range is limited
Solution Approach 1:
The patent segments the communication into two distinct phases: a secure local-range phase for exchanging secret values and random numbers, and a subsequent long-range phase for actual data transmission, allowing each phase to use the most appropriate communication method for its security requirements
Solution Approach 2:
The patent uses a base station as an intermediary that receives secret values securely via local-range channels and then forwards communications over long-range networks, isolating the security-sensitive key exchange from the public network infrastructure
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In accordance with an example aspect of the present invention, there is provided an apparatus comprising at least one receiver configured to receive, via a first channel, a secret value and an identifier of a local node and, via a second channel, a random value, and at least one processing core configured to cause transmission to the local node of a first message comprising a hash value, the hash value being derived based on a set comprising the secret value, the random value, and an instruction.