IoT Device Network Joining via Adaptive Cryptographic Key Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In LoRaWAN networks, devices struggle to join the network securely without direct access to the application server, as they require a shared secret key, which is generally undesirable to share with the network server.
Innovation Solution
A method where a device checks for the presence of a cryptographic key in its memory and uses either the application cryptographic key or a derived network cryptographic key to join the network, allowing secure key derivation and encryption without needing the application server's direct involvement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the application server is used to manage network joining and store the shared secret, then security is improved, but the device cannot join the network if the application server is unavailable
Solution Approach 1:
The patent segments the network joining process into two distinct modes: application server mode (when no network cryptographic key is present) and network server mode (when a network cryptographic key is present). This segmentation allows the device to operate independently of the application server in certain scenarios, improving reliability while managing complexity through conditional logic.
Solution Approach 2:
The patent implements preliminary action by pre-storing a network cryptographic key in the device's memory before network joining operations. This pre-prepared key enables the device to autonomously join the network via the network server without requiring real-time access to the application server, thus improving reliability and reducing dependency.
2Ease of operation
If the shared secret is communicated to the network server, then network joining is simplified, but security is worsened due to key exposure
Solution Approach 1:
The patent introduces a network cryptographic key as an intermediary element that enables communication between the device and network server without exposing the application cryptographic key. The network cryptographic key acts as a mediator that simplifies the joining process while maintaining security boundaries, as it is specifically designed for network-layer operations and does not compromise application-layer security.
Solution Approach 2:
The patent applies local quality by using different cryptographic keys for different purposes: the application cryptographic key remains securely stored and used only for application-layer encryption, while a separate network cryptographic key is used for network joining and network server communication. This differentiation ensures that simplifying network joining does not compromise application security.
3Adaptability or versatility
If the device stores multiple cryptographic keys, then flexibility in joining methods is improved, but memory requirements and complexity increase
Solution Approach 1:
The patent implements dynamics by making the key selection process adaptive rather than static. The device dynamically chooses between application server mode and network server mode based on the presence or absence of a network cryptographic key in memory. This dynamic approach provides versatility in joining methods while avoiding the need to permanently store multiple complete key sets, as only one network cryptographic key is required to enable both modes.
Data Source
Figure 1~4
Figure 5
Figure 6
AI summary
In a network comprising an application server (30), a network server (20) and a device (10) including a memory storing an application cryptographic key, a process is implemented comprising the following steps: - testing by the device of the absence or presence in the memory of a cryptographic key associated with the network; - in the event of the absence of this key, emission by the device (10) of a request to join the network, production of derivation data and encryption of the derivation data by the application server (30) using the application cryptographic key, reception by the device of the encrypted derivation data;- if this key is present, the device (10) issues a request to join the network, the network server produces derivation data and encrypts the derivation data using a network cryptographic key equal to, or derived from, the cryptographic key associated with the network, and the device (10) receives the encrypted derivation data. A process implemented in the device and an associated electronic entity (12) are also shown.