IoT Device Secure Communication via PKI and Attribute Certificates

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

IoT devices, especially those in vehicles, face challenges in secure communication and management, including unauthorized access, data protection, and firmware updates, which can lead to security vulnerabilities and potential hacking risks.

Innovation Solution

A method for establishing secure communication between IoT devices using unique identification, digital identity tokens, cryptographic keys, and attribute certificates, with a central server employing a public key infrastructure (PKI) and inviter-invitee protocol to manage credentials and access, ensuring only authorized communication and firmware updates.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If IoT devices communicate without strong authentication mechanisms, then communication simplicity is maintained, but security vulnerabilities and unauthorized access increase

Engineering Contradiction:

ImprovesecurityVSAvoidauthentication complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system performs authentication and credential verification in advance before allowing communication or firmware updates. IoT devices are pre-provisioned with unique identifiers and cryptographic keys, and the server verifies these credentials before establishing communication channels, preventing unauthorized access before it can occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A central server acts as an intermediary between IoT devices, managing authentication, issuing digital certificates, and controlling access to firmware updates. This mediator handles the complex security protocols centrally, reducing the burden on individual devices while maintaining strong security controls.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If strong authentication and encryption protocols are implemented, then security is improved, but communication overhead and processing time increase

Engineering Contradiction:

ImprovesecurityVSAvoidcommunication delay

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Cryptographic keys and digital certificates are established and cached in advance during device provisioning. Once authenticated, the security context is reused for subsequent communications, avoiding repeated heavy authentication handshakes and reducing ongoing communication overhead.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system dynamically adjusts authentication frequency and encryption parameters based on the established trust relationship. After initial strong authentication, the system maintains security while reducing the frequency of full authentication cycles, optimizing the balance between security and communication efficiency.

Inventive Principle:

Principle #35Parameter changes

3Ease of operation

If centralized server management is used for IoT devices, then security control and firmware update management are improved, but system complexity and single point of failure risks increase

Engineering Contradiction:

Improvedevice managementVSAvoidsystem architecture

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The central server performs multiple functions including authentication, certificate issuance, firmware distribution, and device provisioning through a unified platform. This multi-functional approach consolidates management tasks while distributing security responsibilities across standardized protocols that can be implemented consistently across diverse IoT devices.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Reliability

If digital certificates and cryptographic keys are distributed to all IoT devices, then secure communication is enabled, but device provisioning complexity and storage requirements increase

Engineering Contradiction:

Improvesecure communicationVSAvoidprovisioning process

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The central server acts as a trusted intermediary that generates, manages, and distributes cryptographic credentials to IoT devices. This centralized credential management simplifies provisioning by eliminating the need for complex peer-to-peer key exchange protocols and provides a single point for credential revocation and updates.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system uses digital certificates as cryptographic copies that can be securely distributed and verified without transferring the actual private keys. Each device receives a public key certificate that serves as a verifiable identity copy, enabling secure communication without exposing sensitive cryptographic material.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS10644891B2Secure communication of IoT devices for vehicles

Publication Date: 2020.05.05 T CENT

AI summary

Method for establishing secure communication between a plurality of IoT devices in one or more vehicles include: provisioning the plurality of IoT devices by providing a unique identification, a digital identity token and a cryptographic key to each of the plurality of IoT devices; establishing a secure communication line between the plurality of IoT devices by authenticating respective communication lines between respective IoT devices and issuing a digital certificate to the respective communication lines; grouping the plurality of IoT devices into different groups based on a predetermined criteria; and including a group membership for a group of the different groups in an attribute certificate indicating group characterization.