IoT Gateway Authorization via Peer-to-Peer Channel
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IoT devices often lack secure methods for allowing external network access without centralized subscription servers, leading to vulnerabilities as users may inadvertently expose their home networks to hackers by opening ports and using default credentials.
Innovation Solution
Implementing a system where access requests from external IP addresses are authorized through a hardware processor, which determines if rules apply, sends requests for authorization to an administrator device via an authorization server, and blocks or allows access based on user-defined permissions, including adding IP addresses to a whitelist or blacklist.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If port forwarding is configured to allow external access to IoT devices, then remote accessibility is improved, but network security deteriorates
Solution Approach 1:
The patent introduces a gateway device as an intermediary between external networks and internal IoT devices. The gateway establishes a peer-to-peer connection with the external device and forwards requests through this secure channel, rather than opening direct ports to internal devices. This mediator approach allows remote access while maintaining network security boundaries.
Solution Approach 2:
The system performs preliminary actions by establishing a peer-to-peer connection and obtaining an external IP address before actual access requests are made. The gateway pre-configures the secure communication channel and validates the external device's identity in advance, so that when access is needed, the secure path is already established.
2Ease of manufacture
If default credentials are used on gateways and routers, then ease of setup is improved, but security deteriorates
Solution Approach 1:
The system implements self-service by automatically generating and managing credentials through the peer-to-peer connection process. The external device and gateway autonomously establish secure communication without requiring users to manually configure complex authentication settings, thus maintaining ease of setup while improving security through automated credential management.
3Object-affected harmful factors
If centralized subscription servers are used for IoT device access, then security is improved, but system complexity deteriorates
Solution Approach 1:
The patent extracts the essential security function from centralized subscription servers and implements it locally in the gateway device. The gateway performs peer-to-peer connection establishment, external IP address obtaining, and request forwarding without requiring external server infrastructure. This extraction maintains security while eliminating the complexity of centralized server dependencies.
4Object-affected harmful factors
If multiple authorization checks are performed for each access request, then security is improved, but processing time deteriorates
Solution Approach 1:
The system performs authorization checks in advance during the peer-to-peer connection establishment phase. The gateway validates the external device's identity and establishes the secure channel before any actual data access requests occur. This preliminary authorization reduces the overhead for subsequent access operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Mechanisms for authorizing requests to access a resource are provided, the methods comprising: receiving a request to access the resource at a hardware processor from an Internet Protocol (IP) address; determining whether a rule applies to the request to access the resource; in response to determining that a rule does not apply to the request to access the resource, sending a request for authorization; receiving a response to the request for authorization; and in response to the response to the request for authorization indicating that access is authorized, providing a connection to the resource.