IoT Device Configuration via Smartphone QR Code Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IoT device configuration methods are insecure, relying on default pre-shared keys and resource-constrained devices for Wi-Fi hotspots, making them vulnerable to attacks and difficult for non-technical users to set up securely.
Innovation Solution
A method using a QR code with a digital certificate containing network settings and a manufacturer's signature, scanned by a mobile app to securely configure IoT devices without the need for cameras or scanners, ensuring device genuineness and secure key exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If Wi-Fi hotspot is enabled on IoT device for configuration, then device can be connected and configured, but device becomes vulnerable to DoS attacks and consumes battery resources
Solution Approach 1:
The patent extracts the Wi-Fi hotspot hosting function from the resource-constrained IoT device and relocates it to the user's smartphone. The smartphone creates the hotspot and hosts the configuration web server, while the IoT device only needs to connect to this hotspot and receive configuration data, eliminating the security vulnerabilities and resource consumption associated with hosting services on the IoT device itself.
Solution Approach 2:
The smartphone acts as an intermediary between the IoT device and the configuration process. It hosts the web server, creates the hotspot, and mediates the secure exchange of configuration data and cryptographic keys, allowing the IoT device to be configured without needing to host any services itself.
2Ease of operation
If default pre-shared keys are used for Wi-Fi hotspot, then configuration is simple, but security is compromised as keys are publicly accessible
Solution Approach 1:
The patent implements preliminary action by pre-provisioning each IoT device with a unique cryptographic key pair during manufacturing. The public key is embedded in the device, while the private key is securely stored. This preliminary setup enables secure authentication and encrypted communication from the first configuration attempt, eliminating the need for default keys.
Solution Approach 2:
The system changes the authentication parameter from static default pre-shared keys to dynamic cryptographic key pairs. Each device has unique cryptographic credentials that enable secure authentication and encrypted communication, transforming the security model from shared secrets to public-key infrastructure.
3Reliability
If physical access to device is required for configuration, then security can be maintained, but usability deteriorates for non-technical users
Solution Approach 1:
The patent replaces the mechanical/physical access requirement with cryptographic authentication. Instead of needing physical access to configure a device, users authenticate through the mobile application using secure cryptographic protocols. The configuration process occurs over the wireless connection, substituting physical presence with digital authentication mechanisms.
4Reliability
If QR code scanning requires camera or scanner hardware, then device genuineness can be verified, but manufacturing cost and attack surface increase
Solution Approach 1:
The patent makes the smartphone camera serve multiple functions: it scans the QR code on the IoT device for initial identification, then the same smartphone creates the Wi-Fi hotspot and hosts the configuration server. This universal use of the smartphone's existing camera and processing capabilities eliminates the need for dedicated scanning hardware on either device.
Solution Approach 2:
Instead of requiring specialized scanning hardware, the patent uses the smartphone's existing camera to capture and decode the QR code. The QR code contains or links to cryptographic information that authenticates the device, using a copy of the device's public key embedded in the QR code for verification.
Data Source
AI summary
A method to configure a new IoT device using a smartphone with the IoT device configuration application/service installed. Once the user has added the configuration preferences after successful login to his account on the cloud service using secure communication channel (such as TLS), the user can scan the QR code printed on the device/paper shipped together with the device. After the QR code is scanned, the mobile application decodes the data contained in the QR code, verifies the digital signature, and automatically enables a Wi-Fi hotspot on the smartphone, based on the information retrieved from the QR code. Then, the mobile application informs the user to switch on the IoT device. Once the IoT device is turned on and boots completely, it connects to the hotspot on the smartphone using the default Wi-Fi SSID and PSK saved in its memory (the same as on the QR code).