Decentralized IoT Authentication via Proxy Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional public key infrastructure (PKI) authentication methods are inefficient and costly for large-scale IoT networks, particularly due to high computational and power demands, vulnerability to attacks, and the need for centralized certificate authorities, which are not suitable for billions of mobile and identity-less nodes in IoT systems.
Innovation Solution
A method and system using a proxy for device authentication, where devices generate one-time commitment values from private keys and nonces, and a proxy verifies these values to calculate a digest, enabling secure authentication without relying on centralized authorities or complex PKI, using hash operations to reduce computational burden.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PKI authentication is used for large-scale IoT networks, then authentication security is improved, but computational power and electrical power demands increase significantly
Solution Approach 1:
The patent extracts the heavy computational burden of PKI authentication from the IoT devices themselves and relocates it to a more powerful authentication server. Devices only perform lightweight operations (generating nonces, hashing their own identifiers), while the server handles the complex cryptographic verification and certificate validation, thereby dramatically reducing power consumption on battery-powered sensors.
Solution Approach 2:
The patent introduces an authentication server as an intermediary between IoT devices and the PKI system. This mediator handles the computationally intensive tasks of certificate verification and cryptographic operations, allowing simple devices to authenticate securely without needing to perform complex calculations themselves.
2Reliability
If PKI authentication is used for large-scale IoT networks, then authentication security is improved, but device complexity increases due to multiple layers of CAs
Solution Approach 1:
The patent extracts the complex PKI certificate verification logic from the devices and concentrates it in the authentication server. Devices only need to store their own identifier and perform simple hashing operations, while the server handles all the complex certificate chain validation and cryptographic verification, significantly simplifying device complexity.
Solution Approach 2:
The patent implements self-service authentication where devices autonomously generate their own authentication tokens based on their identifiers and nonces. The system allows devices to authenticate themselves without requiring complex PKI configurations or manual certificate management, reducing operational complexity.
3Device complexity
If gateway authentication is used to simplify authentication, then device complexity is reduced, but vulnerability to attacks increases
Solution Approach 1:
The patent uses an authentication server as a secure intermediary that mediates between devices and the authentication process. This server performs cryptographic verification and certificate validation, ensuring that even if devices are compromised or gates are exposed, the centralized security measures prevent attacks on individual components.
Solution Approach 2:
The patent implements beforehand cushioning by requiring devices to generate fresh nonces and authentication tokens for each authentication attempt. This prevents replay attacks and ensures that even if previous authentication data is exposed, it cannot be reused to compromise future authentication, cushioning against attack vectors.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
First and second devices (100, 101) store respective device data and private keys. The first-device data is additionally stored by the second device and by a proxy (102); and the second-device data is additionally stored by the first device and by the proxy (102). In a commitment phase (6), the first device (100) uses its device data, private key and a first random nonce to generate a one-time first-device commitment value, which it sends to the proxy (102). The second device (101) uses its device data, private key and a second random nonce, to generate a one-time second-device commitment value, which it sends to the proxy (102). In a checking phase (8, 10), the devices (100, 101) communicate secret-key information to the proxy (102), which verifies the received one-time commitment values. In a digest phase (12), the proxy (102) calculates a one-time digest, which it sends to the second device (101). The second device (101) then verifies the received one-time digest to authenticate the first device (100).