IoT Access via Mobile Mediator and Encrypted Challenge
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT devices are vulnerable to cyber attacks, and existing access methods are cumbersome, requiring complex certificate management and password protection, which can be compromised, especially for devices without constant internet access.
Innovation Solution
A method enabling secure access to IoT devices through a mobile device acting as a mediator, using encrypted challenges and authentications via an authentication server, eliminating the need for device-specific passwords and allowing remote configuration and maintenance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password protection and certificate management are used to secure device access, then security is improved, but operation complexity increases and accessibility deteriorates
Solution Approach 1:
The patent introduces a mobile device as an intermediary between the user and the IoT device. The mobile device establishes a communication request with the IoT device, which then transmits an encrypted challenge to the mobile device. This mediator approach simplifies the authentication process for users while maintaining strong security through encrypted challenges and server-verified authentication, eliminating the need for users to directly manage complex passwords or certificates.
Solution Approach 2:
The patent extracts the complex authentication logic from the IoT device and relocates it to a remote authentication server. The IoT device only needs to generate and transmit encrypted challenges, while the server handles the verification of authentication data. This separation allows the IoT device to maintain simple access control mechanisms while the server provides robust security verification, resolving the contradiction between security and ease of operation.
2Reliability
If asymmetric encryption with private/public keys is implemented for secure access, then security is improved, but device complexity increases
Solution Approach 1:
The patent extracts the complex key management and verification operations from the IoT device and relocates them to a remote authentication server. The IoT device only needs to store simple authentication data and generate encrypted challenges using a lightweight algorithm. The server handles the computationally intensive tasks of verifying authentication data and managing cryptographic keys, allowing the IoT device to remain simple while maintaining strong security through server-side verification.
3Ease of operation
If local access control is implemented for devices without internet connection, then accessibility is improved, but security deteriorates
Solution Approach 1:
The patent introduces a mobile device with internet access as an intermediary that bridges the gap between local accessibility and cloud-based security. The mobile device can communicate with the IoT device locally (maintaining accessibility) while also establishing a data connection to the remote authentication server (enabling security verification). This intermediary approach allows devices without direct internet access to benefit from cloud-based authentication through the mediating mobile device.
Solution Approach 2:
The patent adds a temporal and spatial dimension to the authentication process by separating the authentication data storage (local on IoT device) from the verification process (remote on authentication server). The IoT device stores authentication data locally for quick access, while the server performs verification when needed. This dimensional separation allows the system to provide both local responsiveness and remote security verification, resolving the contradiction between accessibility and security.
Data Source
AI summary
A method is for releasing a communication connection between a mobile device and another device, and for an exchange of data between the other device and a server. The method includes sending a communication request to the other device; transmitting an encrypted challenge to the mobile device; transferring the challenge to the server, in the form an authentication server, and checking the access authorization or, if the access authorization is absent, generating an encrypted authentication, and if the access authorization is provided, generating an encrypted authentication and carrying out the following: transferring the encrypted authentication to the mobile device; transmitting the encrypted authentication to the device; and checking the access authorization on the basis of the encrypted authentication, and if the access authorization is absent, outputting a respective transmission to the mobile device, and if the access authorization is provided, releasing the exchanged data.