IoT Device Authentication via DNS Public Key Records
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IoT device authentication methods are inadequate for secure communication, especially when interactions are mediated by untrusted intermediaries, leading to potential data integrity and privacy issues due to the lack of direct authentication between IoT devices and applications.
Innovation Solution
The proposed solution involves using DNS processes and services, specifically DNS-based Authentication of Named Entities (DANE) and DNSSEC, to register and authenticate IoT devices by generating asymmetric key pairs, storing public keys in DNS records, and verifying messages using these keys to ensure authenticity and privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used for IoT devices, then device connectivity and communication are enabled, but security and data integrity are compromised due to lack of direct authentication between devices and applications
Solution Approach 1:
The patent introduces DNS as an intermediary system to store and manage public keys of IoT devices. Instead of complex direct authentication protocols between devices and applications, the DNS system acts as a mediator that stores cryptographic credentials (public keys in TLSA records) that enable secure verification. This reduces authentication complexity while maintaining strong security through the use of standardized DNS infrastructure and asymmetric cryptography.
Solution Approach 2:
The patent implements preliminary action by pre-provisioning asymmetric key pairs on IoT devices during manufacturing or within a predetermined time window. The public keys are then registered with the DNS system in advance, creating a trust foundation before the devices are deployed. This preliminary setup eliminates the need for complex runtime authentication negotiations and enables direct verification between devices and applications.
2Reliability
If direct authentication between IoT devices and applications is implemented, then data integrity and privacy are improved, but system complexity and implementation difficulty increase
Solution Approach 1:
The patent leverages the universality of the DNS system, which is already widely deployed and trusted across the Internet infrastructure. By extending DNS functionality to store cryptographic credentials (through TLSA and SMIMEA record types), the system achieves direct authentication capability without requiring a new specialized infrastructure. This multi-functional use of existing DNS infrastructure simplifies implementation while providing strong data integrity guarantees through cryptographic verification.
Solution Approach 2:
The patent enables self-service authentication where IoT devices automatically present their public keys stored in DNS records for verification. Applications can independently verify device authenticity by retrieving and checking signatures against the stored public keys without requiring manual configuration or complex authentication protocols. This self-service mechanism simplifies operation while ensuring data integrity through cryptographic proof.
3Reliability
If asymmetric key pairs are provisioned on IoT devices during manufacturing, then security is enhanced, but device provisioning time and manufacturing complexity increase
Solution Approach 1:
The patent implements preliminary action by generating and provisioning asymmetric key pairs on IoT devices during the manufacturing process or within a predetermined time window after manufacturing. This advance preparation ensures that devices are security-ready before deployment, eliminating the need for time-consuming key generation and registration steps during field provisioning. The public keys are then registered with DNS, creating a complete authentication foundation in advance.
Solution Approach 2:
The patent allows flexibility in the provisioning timeline by permitting key pair generation either during manufacturing or within a predetermined time window after manufacturing. This parameter change in the provisioning schedule enables optimization based on specific deployment scenarios, balancing manufacturing complexity against deployment flexibility while ensuring security is established before devices become operational.
Data Source
AI summary
Provided herein is a method for registering an IoT device with a DNS registry. The method can include obtaining, at a DNS server, an identifier, IP address, and a public key of an asymmetric key pair associated with the IoT device from a network gateway device that is in communication with the IoT device, wherein the asymmetric key pair is provisioned onto the IoT device and an associated private key stored within a memory of the IoT device at a time that IoT device is manufactured or during a predetermined time window after manufacturing; creating at least one DNS record for the IoT device; assigning a domain name associated with the internet protocol (“IP”) address to the IoT device; storing the identifier, IP address, the domain name, and the public key in the at least one DNS record; and providing confirmation of the registration to the IoT device.