Lightweight Mutual Authentication for Constrained IoT Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Constrained IoT/M2M devices face challenges in deploying robust and lightweight secure communication systems due to high resource usage and maintenance costs of conventional certificate-based schemes, with existing solutions like DTLS being suboptimal for resource-constrained environments and lacking robust authentication of endpoints.
Innovation Solution
A computer-implemented system for two-way authentication using a symmetric key-based security mechanism with challenge-response exchanges, integrating key management and payload-embedded authentication, which reduces the number of handshaking messages and is adaptable with DTLS and CoAP protocols, employing pseudo-random numbers and session keys for mutual authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional certificate-based public key cryptosystem is used for authentication, then robust security is achieved, but processing overhead, energy consumption, and bandwidth requirements increase significantly
Solution Approach 1:
The authentication process is segmented into two distinct phases: provisioning phase where pre-shared secrets are embedded, and operational phase where lightweight challenge-response authentication occurs. This segmentation allows the heavy cryptographic operations to be performed only once during provisioning, while subsequent authentications use lightweight symmetric operations, significantly reducing ongoing energy consumption for constrained devices.
Solution Approach 2:
The pre-shared secret is established in advance during the provisioning phase before the actual authentication takes place. This preliminary action eliminates the need for computationally expensive public key operations during runtime authentication, as devices can directly use the pre-established secret for lightweight challenge-response verification.
2Reliability
If DTLS with full certificate-based PKI is implemented, then robust security is provided, but resource requirements become too costly for constrained devices
Solution Approach 1:
The patent replaces expensive, complex certificate-based authentication with cheap, lightweight pre-shared secret-based authentication. The pre-shared secrets are simple cryptographic keys that can be stored in constrained device memory without requiring complex certificate validation logic, significantly reducing device complexity and resource requirements while maintaining security.
Solution Approach 2:
The authentication mechanism changes from asymmetric cryptography (public key infrastructure) to symmetric cryptography (pre-shared secrets). This parameter change in the cryptographic approach reduces computational complexity, memory requirements, and processing overhead, making it suitable for constrained IoT devices while maintaining authentication security.
3Device complexity
If pre-shared key mode of DTLS is used, then lightweight authentication is achieved, but robustness and endpoint authentication are compromised
Solution Approach 1:
The patent introduces an intermediary challenge-response mechanism where a server-generated challenge acts as a mediator to verify the authenticity of both endpoints. The server sends a challenge that requires the client to prove knowledge of the pre-shared secret, and vice versa. This intermediary verification process enhances robustness and ensures mutual authentication while maintaining the lightweight nature of pre-shared key authentication.
Solution Approach 2:
The authentication process incorporates feedback through challenge-response exchanges where each party verifies the other's authenticity by checking their response to a challenge. This feedback mechanism ensures that both endpoints are genuinely authenticated rather than merely asserting their identity, thereby enhancing authentication robustness while keeping the protocol lightweight.
4Reliability
If cookie exchange technique is used in DTLS to mitigate DoS attacks, then security against amplification attacks is improved, but connection establishment overhead increases
Solution Approach 1:
The pre-shared secret is established in advance during provisioning, eliminating the need for runtime cookie exchange to verify endpoint authenticity. This preliminary action allows direct challenge-response authentication without additional cookie exchange steps, reducing connection establishment time while still providing DoS attack mitigation through the challenge-response mechanism itself.
Data Source
AI summary
A computer implemented system and method for lightweight authentication on datagram transport for internet of things provides a robust authentication scheme based on challenge-response type of exchanges between two endpoints sharing a pre-shared secret. A symmetric key-based security mechanism is utilized in the present disclosure where key management is integrated with authentication. It provides mutual authentication wherein the end-points in the system are provisioned with a pre-shared secret during a provisioning phase and a client database is provided at the server side for client identification. The system comprises random number generators for generation of nonces, and key generators to generate secret key and session key. The nonces and keys are valid only during the session and thus help in providing secure authentication across sessions.The system can be further adapted on transport layer security protocols like DTLS and can be integrated with application layer protocols like CoAP for constrained devices.