IoT Key Management via Offline-Online Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices with limited resources face challenges in secure key management due to high computation costs and latency in existing key exchange protocols, particularly in asymmetric authentication and attestation processes, which are exacerbated by the need for multiple certificates in certificate chains.
Innovation Solution
A system for IoT key management that includes an authority center server and a group manager server, utilizing offline authentication and online group joining phases to establish symmetric keys within a trusted execution environment, allowing for efficient authentication and secure communication among IoT devices without relying on pre-shared secrets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional asymmetric authentication and key exchange protocols are used in IoT devices, then security is improved, but computational overhead and energy consumption increase significantly
Solution Approach 1:
The authentication process is segmented into two distinct phases: an offline phase where cryptographic materials are prepared and cached, and an online phase where only lightweight verification operations are performed. This segmentation allows computationally intensive asymmetric cryptography to be performed offline, while online operations use pre-computed symmetric keys for efficient authentication.
Solution Approach 2:
Cryptographic materials including asymmetric key pairs, certificate chains, and symmetric keys are pre-computed and cached during an offline authentication phase before actual device operation. This preliminary action eliminates the need for real-time asymmetric cryptography during online authentication, significantly reducing computational overhead.
2Reliability
If multiple certificates in certificate chains are used for mutual attestation, then authentication reliability is improved, but computation costs are multiplied and latency increases
Solution Approach 1:
The patent extracts and isolates the computationally intensive certificate chain verification operations to an offline phase. During online operation, devices use pre-verified symmetric keys derived from the certificate chains, eliminating the need for real-time multiplication of computation costs across multiple certificates.
Solution Approach 2:
The patent changes the cryptographic parameter representation by deriving symmetric keys from asymmetric certificate chains offline. This parameter transformation allows the system to maintain the security benefits of multiple certificates while using efficient symmetric cryptography for online authentication, reducing latency significantly.
3Reliability
If resource-intensive security operations are performed on IoT devices with limited processing power, then security is improved, but device performance and scalability deteriorate
Solution Approach 1:
Security operations are segmented into offline preparation (key generation, certificate verification) and online execution (symmetric key authentication). This allows resource-intensive operations to be performed when device performance is less critical, while maintaining high device performance during normal operation.
Solution Approach 2:
The patent introduces symmetric keys as an intermediary between asymmetric certificate chains and device authentication. The symmetric keys act as a mediator that preserves the security properties of complex certificate chains while enabling efficient authentication operations on resource-constrained devices.
Data Source
AI summary
Technologies for key management of internet-of-things (IoT) devices include an IoT device, an authority center server, and a group management server. The IoT device is configured to authenticate with an authority center server via an offline communication channel, receive a group member private key as a function of the authentication with the authority center server, and authenticate with a group management server via a secure online communication channel using the group member private key. The IoT device is further configured to receive a group shared key as a function of the authentication with the group management server, encrypt secret data with the group shared key, and transmit the encrypted secret data to the group management server. Other embodiments are described herein.