IoT Master Key Update via Device Provisioning Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for updating the master key in IoT networks, such as the Thread standard, face challenges including devices being offline or out of range during updates, leading to incomplete key changes and potential security breaches from stolen devices that can intercept communications.
Innovation Solution
A method that derives a Device Provisioning Key (DPK) from a Network Seed Key (NSK) to securely update the master key by establishing unique secure sessions with each device, ensuring all devices receive the new key without requiring repeated commissioning and enhancing security against unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the master key update is broadcast to all devices in the network, then most devices can receive the new key quickly, but devices that are offline or out of range will never receive the update and require complex commissioning
Solution Approach 1:
The patent performs preliminary actions by having devices request the new master key before the actual key change takes effect. Devices send requests ahead of time, and the controller prepares and transmits the new key to all requesting devices in advance, ensuring that even devices temporarily offline can receive the update when they come back online.
Solution Approach 2:
The patent introduces an intermediary mechanism where devices that miss the initial broadcast can send requests to the controller, which then acts as a mediator to provide the new master key through alternative channels. This intermediary request-response system ensures reliable key distribution to all devices regardless of their availability during the initial broadcast.
2Ease of operation
If the master key update is broadcast through the existing network, then the update process is simple, but stolen devices within network range can intercept and decrypt the new key
Solution Approach 1:
The patent segments the key distribution process into multiple independent stages: (1) devices send individual requests to the controller, (2) the controller generates and sends new keys separately to each requesting device through secure individual channels, and (3) devices independently store their received keys. This segmentation prevents a single broadcast from being intercepted by multiple devices simultaneously.
Solution Approach 2:
The controller serves as a secure intermediary that mediates between the key generation source and individual devices. Instead of direct device-to-device or broadcast key distribution, the controller receives key material, processes it securely, and distributes it individually to authorized devices through protected channels, blocking potential interception by unauthorized devices.
3Reliability
If commissioning is required for devices that miss the key update broadcast, then security can be maintained, but user convenience is significantly reduced
Solution Approach 1:
The patent performs preliminary key distribution to all devices before the master key change takes effect. Devices are given advance notice and opportunity to request the new key, so when the actual key change occurs, all devices already possess the updated key without requiring re-commissioning or user intervention.
Solution Approach 2:
The patent enables devices to self-serve by automatically sending requests for the new master key to the controller when they detect the need for update. This automated self-service mechanism eliminates the need for manual user commissioning actions, maintaining both security through controlled key distribution and convenience through automation.
Data Source
AI summary
A method is provided for providing a new master key to devices in a Thread network for an Internet of Things (IOT). To provide the new master key, Device Provisioning Key (DPK) is generated from a Network Seed Key (NSK) known to a Commissioner and Leader in a local network. The Commissioner provides the DPK as a unique per-device key to each device in the network to establish a secure session. The DPK is derived from the NSK as follows: DPK=OWF(NSK, ID), wherein OWF is a One Way Function, and ID is a unique device identifier for each device. The new master key can then be sent from the commissioner to the new devices to establish a secure session created using the DPK.