IoT Edge Device Secure Mobile Recognition via Dynamic Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies for recognizing mobile devices are insecure, allowing non-trusted third-parties to recognize devices due to shared encryption keys and limitations in wireless protocols like Bluetooth Low Energy (BLE), which can compromise user identity and experience.
Innovation Solution
A method using a private, rotating identifier token generated and validated by a trusted party, embedded in the mobile device, to securely identify the device and prevent non-trusted parties from persistent identification, while meeting bit size constraints for transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a static encryption key is used to encrypt device ID, then the device can be recognized by the application, but a non-trusted third-party can decompile the application to obtain the encryption key and decrypt device IDs
Solution Approach 1:
The patent transforms the static encryption key into a dynamic token that changes over time. The token is generated by the server using a hash function that incorporates a secret key and a counter, ensuring that each token is unique and time-limited. This dynamic approach prevents non-trusted third parties from obtaining permanent access to device identifiers through decompilation, as the tokens expire and rotate automatically.
Solution Approach 2:
The patent introduces a server as an intermediary between the mobile device and the application. The server generates and manages the encrypted tokens, acting as a trusted third party that neither the application nor the device can compromise alone. This intermediary architecture centralizes security management and prevents local key extraction attacks.
2Ease of operation
If BLE advertisement messages contain smartphone address, then the smartphone can be identified by receiving BLE stations, but the address is not useful for identification except to a previously bonded station
Solution Approach 1:
The patent changes the identification parameter from a static BLE address to a dynamic encrypted token. The token is generated by hashing a secret key with a counter, producing a time-limited identifier that can be transmitted in BLE advertisements. This allows any receiving station to identify the device without prior bonding, while the encryption prevents unauthorized stations from obtaining meaningful identification information.
3Reliability
If bonding is required for secure communication, then encrypted communication can be established, but a user prompt is displayed that may confuse or disrupt user experience
Solution Approach 1:
The patent performs the security setup in advance by having the server generate and distribute encrypted tokens to devices before actual communication occurs. The tokens are pre-configured with expiration times and can be automatically renewed, eliminating the need for runtime bonding prompts. This preliminary security configuration maintains encrypted communication security while providing a seamless user experience.
4Reliability
If encryption techniques are applied to BLE packets, then security is improved, but BLE packet size constraints and other limitations make existing techniques challenging
Solution Approach 1:
The patent extracts the heavy encryption computation from the resource-constrained BLE device and relocates it to a powerful server. The mobile device only needs to store a small secret key and generate simple tokens by incrementing a counter and hashing it with the key. This extraction approach maintains strong encryption security while minimizing the computational burden on BLE devices, easily meeting packet size and processing constraints.
Data Source
AI summary
Techniques for secure mobile device recognition are disclosed. An IOT edge device determines, based on a network message received at the IOT edge device, that a mobile device is not recognized. The IOT edge device transmits a token request to the mobile device. In response, the IOT edge device receives an encrypted token from the mobile device. The IOT edge device transmits the encrypted token to a server. The server is configured to determine an identifier corresponding with the mobile device, based on the encrypted token. A recognition task is initiated for the mobile device, based on the determined identifier.