IoT Device Ownership via DNS Authentication Records
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing demand for secure interactions with Internet of Things (IoT) devices poses challenges in protecting data privacy, as existing authentication methods are inadequate for verifying the authenticity of messages and managing ownership changes in a decentralized IoT environment.
Innovation Solution
A method utilizing Domain Name System (DNS) records, specifically DANE records and attribute records, to establish and verify ownership of IoT devices by generating authentication files that identify the chain of ownership, allowing secure registration, authentication, and transfer of ownership through a registration service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing authentication methods are used for IoT devices, then device connectivity is maintained, but data privacy and message authenticity cannot be verified
Solution Approach 1:
The patent applies universality by making the DNS system serve multiple functions: it continues to provide domain name resolution while simultaneously serving as an authentication and ownership verification system through DNSSEC and DANE records. This allows the existing DNS infrastructure to handle both traditional networking tasks and new security requirements without adding separate authentication systems.
Solution Approach 2:
The patent uses DNSSEC-signed DNS records as an intermediary mechanism between IoT devices and verification systems. The DNS records act as a trusted mediator that contains cryptographic evidence (TLSA records, ownership chains) that enables verification of device authenticity and ownership without requiring direct complex authentication protocols between all parties.
2Reliability
If DNS records are used to establish ownership, then authentication and privacy protection are improved, but system implementation complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-generating and storing cryptographic key pairs and ownership chain evidence in DNS records before authentication is needed. The DNSSEC signatures and DANE TLSA records are prepared in advance, so when verification is required, the system can immediately query existing records rather than performing complex cryptographic operations in real-time.
Solution Approach 2:
The system enables self-service authentication where IoT devices and verification systems can independently verify ownership and authenticity by querying DNS records without requiring centralized authentication servers or manual verification processes. The DNS infrastructure itself provides the verification capability through its signed records.
3Loss of information
If decentralized authentication is implemented, then privacy protection is enhanced, but scalability and management become more difficult
Solution Approach 1:
The patent leverages the universal nature of the DNS system, which is already a globally distributed and scalable infrastructure. By building authentication and privacy protection on top of this existing universal system, the solution inherits its scalability and distributed architecture without needing to create a new centralized system from scratch.
Solution Approach 2:
The patent adds a new dimension to the DNS system by incorporating cryptographic layers (DNSSEC signatures, DANE TLSA records, ownership chains) into the existing DNS protocol structure. This allows privacy and authentication functionality to be layered onto the scalable DNS infrastructure without changing its fundamental distributed architecture.
Data Source
AI summary
Provided is a method for establishing ownership of a component of an internet of things (“IoT”) device. The method comprises receiving, at a registration service, a request to register the component of the IoT device, the request comprising a public key of the component of the IoT device, an identifier of the component of the IoT device, and a public key of an owner of the component of the IoT device; determining a qualified name for the component of the IoT device based on a name associated with the owner of the component of the IoT device; generating one or more domain name system (“DNS”) records for the component of the IoT device, the one or more DNS records comprising an authentication file that identifies a chain of ownership of the component of the IoT device; and storing the one or more DNS records in a registry.