IoT Key Exchange via Pre-Shared Key and Asymmetric Relay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional solutions for establishing secure connections in IoT devices are not practical and can compromise security due to flaws in key sharing methods, particularly for low-performance connected devices that require low power consumption and limited processing capabilities.
Innovation Solution
A method using a pre-shared key (PSK) to establish a secure connection between a low-performance connected device (LPCD) and a dedicated remote service (DRS), followed by asymmetric encryption to securely send a new symmetric key to a third party, enabling secure communication between the LPCD and the third party device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional key sharing methods are used for secure connections, then security can be maintained, but power consumption and processing requirements increase beyond what low-performance devices can handle
Solution Approach 1:
A pre-shared key (PSK) is pre-configured in both the low-performance device and the server before actual communication begins. This preliminary key exchange allows the device to establish secure connections without performing computationally intensive key generation or exchange operations during runtime, thereby maintaining security while minimizing power consumption and processing requirements.
Solution Approach 2:
The server acts as an intermediary that facilitates secure communication between the low-performance device and third-party devices. The server performs the computationally intensive asymmetric encryption operations and key management, while the low-performance device only needs to implement simple symmetric encryption using the pre-shared key, thus reducing the power and processing demands on the constrained device.
2Reliability
If asymmetric encryption is implemented for secure key exchange, then security is improved, but device complexity and processing requirements increase
Solution Approach 1:
The encryption system is segmented into two distinct parts: asymmetric encryption implemented only on the server side for secure key exchange, and symmetric encryption implemented on both the server and low-performance device for actual data communication. This segmentation allows the computationally complex asymmetric operations to be performed only where necessary (on the server), while the device uses simpler symmetric operations.
Solution Approach 2:
Asymmetric encryption is applied partially rather than comprehensively - it is used only for the initial key exchange between the server and third-party devices, while the actual communication between the low-performance device and server uses simpler symmetric encryption with pre-shared keys. This partial application of asymmetric encryption maintains security for critical operations while avoiding the excessive processing burden on constrained devices.
3Use of energy by moving object
If simple pre-shared key methods are used, then power consumption is reduced, but security vulnerabilities increase due to key sharing flaws
Solution Approach 1:
The system merges the advantages of both pre-shared key methods and asymmetric encryption by combining them in a hybrid approach. The pre-shared key provides simple, low-power symmetric encryption for device-to-server communication, while asymmetric encryption is used by the server for secure key exchange with third-party devices. This combination maintains low power consumption on the device while eliminating the security vulnerabilities of pure pre-shared key systems through the server's asymmetric encryption capability.
Data Source
AI summary
Securely exchanging keys to establish secure connections to low powered connected devices (LPCDs), such as smart devices and IoT (Internet Of Things) devices, and mutual authentication between these devices and third party controllers is accomplished via a higher performance machine configured with a dedicated remote service (DRS). A known symmetric pre-shared key (PSK) is used to establish a secure first connection between the LPCD and the DRS using another symmetric key. The DRS can then use asymmetric key exchange to securely send a new symmetric key to the 3P, and send the same new symmetric key to the LPCD using the secure first connection. This facilitates LPCDs to securely establish secure communications with other devices, in particular for control by third party (3P) devices. This also allows authentication of the LPCD with cloud services, and enables a DRS to vouch for associated devices to other DRSs.