IoT Data Transmission via Gateway Security Offloading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing IPsec protocol requires high storage and computational capabilities for IoT devices, making it difficult to ensure end-to-end secure communication due to high storage overheads and computational burdens, which many IoT devices with limited resources cannot meet, leading to security risks.
Innovation Solution
A data transmission method where a third-party device handles security processing, including verifying and encapsulating data packets using security associations (SAs), reducing the computational and storage burdens on IoT devices by sharing these tasks and storing SAs centrally, allowing IoT devices to focus on parsing and encapsulating data using received SAs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the IPsec protocol is used to implement end-to-end secure transmission, then communication security is ensured, but storage overheads and computational overheads of transceiver nodes increase significantly
Solution Approach 1:
The patent introduces a gateway device as an intermediary between IoT devices and external network devices. The gateway device stores security associations (SAs) and performs authentication header verification, while IoT devices only store minimal identification information. This intermediary approach resolves the contradiction by centralizing storage requirements at the gateway while maintaining end-to-end security verification capabilities.
2Reliability
If the IPsec protocol is used to implement end-to-end secure transmission, then communication security is ensured, but computational overheads of transceiver nodes increase significantly
Solution Approach 1:
The gateway device acts as a computational intermediary that handles the heavy lifting of authentication header verification using stored SAs. IoT devices with limited computational power only need to perform lightweight operations such as generating identification information and verifying signatures, significantly reducing their computational overhead while maintaining security.
Solution Approach 2:
The patent segments the security verification process into two parts: (1) The gateway device performs authentication header verification using stored SAs, and (2) IoT devices perform lightweight signature verification. This segmentation allows computationally intensive operations to be performed by the gateway while keeping IoT device requirements minimal.
3Reliability
If each transceiver node stores keys for verification with multiple other nodes, then end-to-end secure communication is ensured, but storage capability requirements increase
Solution Approach 1:
The gateway device serves as a centralized storage intermediary that maintains security associations with all external network devices. IoT devices only need to store identification information (such as external network device addresses) rather than actual cryptographic keys. This approach maintains end-to-end secure communication capabilities while dramatically reducing storage requirements at IoT devices.
Data Source
AI summary
A data transmission method, device, and system are provided. The method includes: receiving a first data packet sent by an external network device; verifying an authentication header (AH) packet header of the first data packet by using a first security association (SA); and sending the first data packet to an internet of things (IoT) device if the verification succeeds. According to the embodiments of this application, storage overheads and computational overheads of the IoT device in internet of things can be reduced, to implement end-to-end secure communication between the IoT device and the external network device, and improve security of a communications system.