IoT Protection Service via Edge Server Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices are vulnerable to attacks due to unpatched software, exposure to the internet without network firewalls, and low installation rates of security updates, especially in critical functions like industrial control and medical spaces.
Innovation Solution
An IoT protection service that creates a private network around IoT devices, using edge servers with web application firewall rules and mutual TLS authentication to secure communications and block exploits, even if the devices run unpatched code, thereby providing an additional layer of security and authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If IoT devices are exposed to the internet without network firewalls to enable connectivity, then device accessibility and functionality are improved, but security vulnerability and susceptibility to attacks increase
Solution Approach 1:
The patent introduces a network-level security service as an intermediary between the IoT device and the external network. This service acts as a mediator that inspects, filters, and controls traffic before it reaches the device, thereby enabling the device to remain accessible while protecting it from harmful attacks. The intermediary service implements security functions without requiring changes to the IoT device itself.
2Reliability
If manufacturers send security updates to patch vulnerabilities, then device security is improved, but device downtime and operational disruption increase
Solution Approach 1:
The patent applies preliminary action by deploying security measures at the network level before vulnerabilities can be exploited. Instead of waiting for devices to receive and install patches, the system proactively blocks malicious traffic and exploits through network-level filtering and inspection. This allows security protection to be established in advance without requiring device reboots or updates.
Solution Approach 2:
The network-level security service serves as an intermediary that provides continuous security protection without requiring direct interaction with the IoT device. The service handles security functions externally, eliminating the need for devices to shut down for maintenance or updates, thereby preventing operational disruption while maintaining security.
3Ease of operation
If IoT devices use default usernames and passwords for ease of setup, then device configuration simplicity is improved, but authentication security and vulnerability to unauthorized access increase
Solution Approach 1:
The patent introduces an intermediary authentication service that handles security verification externally. Instead of relying on default credentials stored in the device, the system uses network-level authentication mechanisms that verify device identity and authorization before allowing access. This maintains simple device setup while strengthening authentication through centralized security services.
Solution Approach 2:
The patent extracts authentication and security functions from the IoT device itself and places them in a dedicated network service. By taking out security responsibilities from the device, the system eliminates the vulnerability associated with default credentials while preserving the simplicity of device configuration. The extracted security service provides robust authentication without requiring changes to the device's default settings.
4Reliability
If manufacturers create security patches for vulnerabilities, then device security is improved, but patch installation complexity and user burden increase
Solution Approach 1:
The patent introduces a network-level security service as an intermediary that provides security protection without requiring direct device intervention. This service handles vulnerability mitigation through network traffic filtering and inspection, eliminating the need for users to manage patch installation. The intermediary service absorbs the complexity of security updates while presenting a simple, secure connection to the IoT device.
Solution Approach 2:
The network-level security service operates autonomously to provide continuous protection without requiring user action. Instead of burdening users with patch installation, the system self-manages security functions through automated network-level filtering and monitoring. This self-service approach maintains high security standards while completely eliminating patch installation complexity from the user perspective.
Data Source
AI summary
An Internet of Things (IoT) protection service at the network level is described. A secure session is established between an edge server and an IoT client that is requesting to send data to an IoT device. The edge server receives the request from the IoT client over the secure session instead of the IoT device directly because a Domain Name System (DNS) request for a unique fully qualified domain name assigned to the IoT device returns an IP address of the edge server instead of an IP address of the IoT device. The edge server analyzes the request to determine whether to transmit the request to the IoT device, including applying web application firewall rule(s) against the request. If the request does not trigger any rule, then the edge server transmits the request to the IoT device. If the request triggers any rule, then the edge server blocks the request.