IoT Device Public Key for Secure Initial Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing initial network access in IoT devices are inefficient, particularly for resource-constrained devices, as they require dedicated cryptographic materials and are not interoperable across various networks, leading to suboptimal memory usage and increased manufacturing costs.
Innovation Solution
A method using a device public key as a shared secret for network authentication, allowing IoT devices to obtain initial access to networks without temporary cryptographic material, and enabling secure provisioning of credentials while reducing memory usage and manufacturing complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dedicated cryptographic materials are used for initial network access, then security is improved, but memory usage increases and device complexity increases
Solution Approach 1:
The device public key is designed to serve multiple functions: it acts as both the authentication credential for initial network access and as the shared secret for establishing secure communication channels. This eliminates the need for separate dedicated cryptographic materials, reducing memory usage while maintaining security.
Solution Approach 2:
The patent combines the authentication function and the key exchange function into a single cryptographic mechanism. The device public key is merged with the shared secret generation process, allowing the same material to be used for both initial access authentication and subsequent secure communication setup.
2Reliability
If dedicated cryptographic materials are used for initial network access, then security is improved, but device complexity increases
Solution Approach 1:
The device public key serves multiple purposes including authentication during initial network access and establishing shared secrets for secure channels. This multi-functionality reduces the number of separate cryptographic components needed, thereby simplifying device complexity.
3Reliability
If temporary cryptographic material is used for initial network access, then authentication is improved, but interoperability across networks deteriorates
Solution Approach 1:
The device public key is a universal credential that can be used for initial network access authentication across different network types (cellular, Wi-Fi, Bluetooth). This universality enables interoperability while maintaining strong authentication, as the same key pair works across multiple network access technologies.
4Reliability
If manual configuration of credentials is performed, then security provisioning is improved, but manufacturing time increases
Solution Approach 1:
The device autonomously performs the credential provisioning process by using its pre-configured device public key to authenticate and automatically obtain additional credentials from a credential server. This self-service capability eliminates the need for manual configuration, significantly reducing manufacturing time while maintaining security provisioning.
Solution Approach 2:
The device public key is pre-configured during manufacturing, enabling the device to autonomously provision additional credentials later. This preliminary configuration of essential identification material allows for rapid deployment without manual intervention during the provisioning phase.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This disclosure provides a method, performed in a wireless device 60, for obtaining initial access to a network 700, 800 in order to establish a connection to a server 80 connected to the network 700, 800. The wireless device 60 stores a device public key and a device private key. The server 80 stores the device public key. The method comprises transmitting S1 an initial access request to a network node 70 of the network 700, 800 and receiving S2 an authentication request from the network node 70, the authentication request comprising a challenge. The method comprises generating S4 a device authenticator based on the challenge and the device public key, and transmitting S5 an authentication response to the network node 70. The authentication response comprises the device authenticator. The method comprises receiving S6 an initial access response from the network node 70, the initial access response comprising an indicator of whether the initial access is granted or denied.