IoT Entrance Security via Multi-Factor Time-Based Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IoT-based entrance/exit systems rely on single-factor authentication, which is insecure as modifying identification devices, such as mobile devices, to spoof authentication is easy, compromising security.
Innovation Solution
Implementing a multi-factor authentication system using IoT devices with processors and storage for generating time-based passwords, verified through a wireless network, where identification devices must match a secret key and access time to gain access, incorporating a data store for authenticated addresses and keys, and modules for secure connection establishment, address filtering, and entrance control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If single-factor authentication is used with identification devices, then the system is simple to operate, but the security is compromised because modifying devices to spoof authentication is easy
Solution Approach 1:
The authentication process is segmented into multiple independent verification steps: first verifying the wireless address of the identification device, then generating and verifying a time-based password. This segmentation transforms a single vulnerable authentication point into multiple security layers, where each segment (address verification, time-based password generation, password verification) must succeed independently for access to be granted.
Solution Approach 2:
The system performs preliminary actions by pre-establishing trusted wireless addresses in the IoT device's memory before authentication occurs. When an identification device attempts to connect, the system first checks if its wireless address matches pre-stored trusted addresses before proceeding to password verification. This preliminary verification of device identity prevents unauthorized devices from even attempting password authentication.
2Reliability
If multiple verification steps are implemented, then security is enhanced, but the authentication process becomes more complex
Solution Approach 1:
The identification device automatically generates the time-based password using its internal clock and the shared secret key, without requiring manual user input. The user simply presents their identification device (e.g., mobile phone), and the device autonomously performs the complex cryptographic operations to generate and transmit the password, making the multi-factor authentication transparent and easy for users while maintaining strong security.
Solution Approach 2:
The system dynamically changes the password parameter over time by generating a new time-based password for each authentication attempt. The password is derived from the current time and a secret key, ensuring that even if a password is intercepted, it becomes invalid after a short time window. This temporal parameter change prevents replay attacks while maintaining automated operation.
3Object-affected harmful factors
If time-based passwords with secret keys are used, then spoofing becomes difficult, but the system requires more verification steps
Solution Approach 1:
The authentication system transitions from static credentials (fixed passwords or keys) to dynamic credentials that change continuously based on time. The time-based password is regenerated for each authentication attempt, ensuring that even if an attacker obtains one password, it becomes obsolete immediately. This dynamic approach makes spoofing difficult while the automated verification process manages the complexity.
Solution Approach 2:
The time-based password acts as an intermediary between the shared secret key (which never needs to be transmitted) and the authentication verification. The secret key remains securely stored in both the IoT device and identification device, while the time-based password serves as a temporary, single-use credential that mediates the authentication process without exposing the permanent secret key.
Data Source
AI summary
Certain aspects direct to systems and methods for securing an internet of things (IoT) based entrance for a designated area with multi-factor authentication. The system includes an IoT based entrance having an IoT device, which stores a secret key for generating a time-based password. An authenticated identification device may also have the same secret key. When the IoT device receives a request from an identification device to establish a secured connection, the IoT device first verifies the wireless address of the identification device. Once the wireless address is verified, the IoT device establishes the secured connection with the identification device through the wireless network. Then the IoT device uses the secret key and a current access time to generate the time-based password, and receive a second time-based password from the identification device through the secured connection. If both time-based passwords match each other, the identification device is authenticated.