IoT Group Authorization via Cloud Account Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional IoT systems face challenges with time-consuming account management, security concerns, and inefficient resource authorization due to peer-to-peer network connections and the reliance on relay servers, which increase network delay and bandwidth usage.
Innovation Solution
An IoT system with a cloud account server managing user accounts and authorization lists, allowing users to create friend, group, and others lists for convenient authorization distribution, and utilizing encryption with private and public keys for secure communication, thereby reducing the need for individual account setups and enhancing data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a P2P network connection mechanism is used for IoT device connections, then direct device-to-device communication is enabled, but each IoT device must establish exclusive accounts and passwords for every connection, leading to time-consuming management
Solution Approach 1:
The patent implements a universal account system where a single account can be shared across multiple IoT devices through group authorization. Instead of requiring exclusive accounts for each device connection, the system allows users to create groups and authorize multiple devices under one account, making the authorization mechanism universal and reusable across different devices and scenarios.
Solution Approach 2:
The patent introduces a server as an intermediary that manages authorization between users and IoT devices. The server stores authorization relationships and verifies credentials, mediating the connection process between devices. This intermediary handles the complex account management tasks centrally, freeing individual devices from maintaining exclusive credentials while preserving connection security.
2Ease of operation
If a relay server mechanism is used to establish network connections through firewalls, then connection establishment is enabled, but network delay time increases because data passes through the relay server
Solution Approach 1:
The patent implements a dynamic connection strategy that adapts between relay server mode and direct P2P mode. The system initially uses the relay server to establish connections through firewalls, then dynamically switches to direct P2P communication once the connection is established. This dynamic approach combines the ease of relay server connection establishment with the speed of direct communication.
Solution Approach 2:
The patent uses the relay server for preliminary connection establishment and authentication, performing the necessary handshake and credential verification in advance. Once the preliminary connection is established through the relay server, the system prepares and transitions to direct P2P communication for actual data transmission, separating the connection setup phase from the data transfer phase.
3Ease of operation
If a relay server is used to temporarily store and forward connection data, then firewall traversal is enabled, but bandwidth usage by the cloud server network increases
Solution Approach 1:
The relay server performs preliminary authentication and connection establishment tasks, using bandwidth intensively only during the initial connection phase. Once connections are established, the system transitions to direct P2P communication for data transmission, minimizing the relay server's bandwidth consumption to only control plane traffic rather than data plane traffic.
Solution Approach 2:
The system dynamically adjusts the use of relay server resources based on connection state. The relay server is actively used for connection setup and authentication, then becomes passive or unused during data transmission phases. This dynamic resource allocation ensures firewall traversal capability while minimizing sustained bandwidth consumption by the cloud server network.
4Reliability
If individual accounts are established for each IoT device resource access, then resource security is maintained, but authorization management becomes time-consuming and complex
Solution Approach 1:
The patent implements group-based authorization where a single account can authorize access to multiple devices and resources through group membership. Instead of requiring separate accounts for each resource, the system creates universal groups that can include multiple devices, users, or both, providing flexible and reusable authorization templates that reduce management complexity while maintaining security.
Solution Approach 2:
The patent merges multiple authorization relationships into group structures. Instead of managing individual device-to-user authorizations separately, the system combines multiple devices into groups and assigns authorization at the group level. This merging reduces the number of individual authorization decisions needed and simplifies the overall authorization management structure.
5Adaptability or versatility
If different resource authorization protocols are integrated, then compatibility with various IoT devices is achieved, but system development time increases significantly
Solution Approach 1:
The patent implements a universal authorization protocol that works across different device types and resource categories. The group-based authorization mechanism is designed to be protocol-agnostic, providing a unified approach that can authorize access to storage, surveillance, display, and other IoT resources without requiring separate protocol implementations for each resource type.
Solution Approach 2:
The authorization system is designed to be universally applicable across different IoT scenarios and device types. The group authorization mechanism can be reused for various resource types (storage, surveillance, display, etc.) without modification, providing a multi-functional authorization framework that reduces development time while maintaining broad compatibility.
Data Source
AI summary
The present application discloses an Internet of Things (IoT) system, comprising a cloud account server, configured to manage user accounts corresponding to the users respectively, wherein the users comprise a first user; a plurality of IoT devices, communicating with the cloud account server respectively, wherein the plurality of IoT devices including a first IoT device corresponding to the first user, and the first IoT device preserves a first authorization list set by the first user; and a plurality of peripheral devices, including a first peripheral device connected to or communicating with the first IoT device. The first IoT device determines whether other users possess a first authority to access the first peripheral device based on the first authorization list.