IoT Device Secure Channel via Server-Mediated Symmetric Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Memory-constrained and processing-limited devices in the Internet of Things (IoT) face challenges in establishing protected communication channels with servers due to the complexity and resource requirements of asymmetric key cryptography, making it difficult to generate and distribute secure keys.
Innovation Solution
A method where a device and a second server derive a symmetric key based on a device identifying key and public key information, which is then transmitted to a first server over a secure channel, enabling secure communication without relying on the device's ability to generate asymmetric keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric key cryptography is implemented on IoT devices, then security and trust in device identity are improved, but device complexity and memory requirements increase
Solution Approach 1:
A key distribution server acts as an intermediary between the IoT device and the communication partner. The server generates asymmetric key pairs, stores private keys securely, and distributes public keys and certificates. This eliminates the need for IoT devices to implement complex asymmetric cryptography locally, while still providing security and identity verification through the server-mediated key distribution process.
Solution Approach 2:
The complex asymmetric key generation and management functionality is extracted from the resource-constrained IoT device and relocated to a powerful key distribution server. The device only retains simple symmetric key operations and the ability to verify certificates issued by the server, significantly reducing its computational and memory requirements while maintaining security.
2Reliability
If asymmetric key cryptography is used for protected communication, then confidentiality and trust are improved, but processing power and energy consumption increase
Solution Approach 1:
The cryptographic functionality is segmented into two parts: asymmetric key operations performed once during device provisioning and certificate issuance by the server, and lightweight symmetric key operations performed continuously during communication by the IoT device. This segmentation allows the energy-intensive asymmetric operations to be performed only when needed for initial setup, while routine communication uses energy-efficient symmetric encryption.
Solution Approach 2:
Asymmetric key pairs and digital certificates are generated and distributed in advance during device provisioning, before the IoT device needs to engage in protected communication. This preliminary action eliminates the need for the device to perform complex asymmetric operations during actual communication, reducing real-time energy consumption while maintaining trust and identity verification.
3Reliability
If symmetric key is derived and transmitted from second server to first server, then key distribution security is improved, but communication channel complexity increases
Solution Approach 1:
The key distribution server acts as a trusted intermediary that derives symmetric communication keys using the device's private key and the intended server's public key. The server then securely transmits these derived keys to both the device and the intended server through established protected channels. This intermediary approach simplifies the key distribution protocol compared to direct peer-to-peer key exchange, as the server manages the complex key derivation and distribution logic centralised in one location.
Data Source
AI summary
To establish a first protected communication channel between a device D and a first server S, a symmetric key KS is derived at the device D, based on a device identifying key KD and public key information dependent on a first server public key Spublic of the first server S. The symmetric key KS is derived in a corresponding way at a second server T. The symmetric key KS is transmitted from the second server T to the first server S on a second protected communication channel. Communication on the first protected communication channel between the device D and the first server S is protected using a communication key KC which is dependent on the symmetric key KS. This can enable a device D lacking support for asymmetric key cryptography to securely enter into communication with the first server S.