IoT Gateway Security Authentication and Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security infrastructure for IoT devices is inadequate, with limited processing power, memory, and user interface elements making them difficult to integrate into existing client-server security systems, and existing access control methods are vulnerable to unauthorized access and eavesdropping due to lack of authentication and encryption.
Innovation Solution
A computer-implemented method and system that centrally manages user and device identities and access control policies using a gateway, which authenticates sessions and encrypts communications between IoT devices, employing a distributed ledger to secure network access and enforce access control policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional client-server security systems are used for IoT devices, then authentication and access control can be implemented, but the system complexity and resource requirements exceed the limited processing power and memory of IoT devices
Solution Approach 1:
The patent introduces a gateway as an intermediary component that handles authentication and access control operations. The gateway maintains security credentials and policies, acting as a mediator between IoT devices and the network. This allows IoT devices with limited resources to offload complex authentication tasks to the gateway, which has sufficient processing power and memory to handle security operations.
2Device complexity
If simple access control mechanisms are implemented on IoT devices, then resource consumption is minimized, but the system becomes vulnerable to unauthorized access and locking by malicious actors
Solution Approach 1:
The gateway serves as a secure intermediary that manages access control policies and credentials. Instead of implementing complex security mechanisms directly on resource-constrained IoT devices, the gateway handles authentication requests, maintains security policies, and controls access to devices. This protects against unauthorized locking and access while keeping device resource consumption low.
Solution Approach 2:
The system performs preliminary authentication and access control decisions at the gateway before allowing communications to reach IoT devices. Security credentials are verified and access policies are enforced in advance, preventing malicious actors from directly interacting with devices. This preliminary security check at the gateway layer protects devices without requiring complex local security implementations.
3Use of energy by moving object
If plain text communications are used between IoT devices, then energy consumption and processing overhead are minimized, but the communications become vulnerable to eavesdropping and unauthorized access
Solution Approach 1:
The gateway acts as a secure communication intermediary that encrypts data before transmission and decrypts it upon receipt. Instead of implementing encryption/decryption on resource-constrained IoT devices, the gateway handles these operations, protecting communications from eavesdropping while minimizing energy consumption and processing overhead on the IoT devices themselves.
Data Source
AI summary
A computer-implemented method comprises accessing, by a networking hardware device, identity awareness data for a plurality of client computing devices and device security policies of a plurality of IoT computing devices from at least one distributed data repository; authenticating, by the networking hardware device, a client computing device requesting access to at least one Internet of Things (IoT) computing device, based on the accessed identity awareness data; establishing, at the networking hardware device, firewall rules based on the accessed device security policies; creating, by the networking hardware device, a session for the authenticated client computing device to communicate with the at least one IoT computing device, wherein creating a session comprises posting information relating to the session as authentication session information to the at least one distributed data repository.