IoT Security Module Using Attribute-Based Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security protocols for network devices, particularly MCUs in IoT applications, face challenges due to high processing and storage overhead, power consumption, and the need for internet connectivity to manage encryption keys and certificates, limiting their effectiveness in secure communication.
Innovation Solution
A method involving a computer-implemented system that uses a key issuing platform to generate time-limited encryption keys based on attributes of command data, allowing client devices to encrypt and transmit command data packets to MCUs without requiring stored individual keys or internet connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Public Key Cryptography (PKC) is used for secure communication, then encryption security is improved, but processing overhead and power consumption increase significantly
Solution Approach 1:
The patent segments the key management functionality by separating the key issuing platform (remote server) from the control unit (embedded device). The control unit only stores a base key and generates time-limited encryption keys locally using a deterministic algorithm, avoiding the need to perform full PKC operations locally. This segmentation reduces processing overhead and power consumption on the embedded device while maintaining security through the remote key issuing platform.
2Reliability
If certificates and key validation are implemented, then security is improved, but device complexity and storage requirements increase
Solution Approach 1:
The patent extracts the complex certificate validation and key management functions from the embedded control unit and places them on a remote key issuing platform. The control unit only retains a simple base key and a deterministic key generation algorithm, eliminating the need for complex certificate storage and validation logic in the embedded device. This extraction reduces device complexity while maintaining security through the remote platform's validation capabilities.
3Measurement precision
If individual client keys are stored on the server, then authentication accuracy is improved, but storage overhead increases significantly
Solution Approach 1:
The patent changes the parameter of key storage from storing multiple individual client keys to storing a single base key on both the key issuing platform and control units. Each control unit generates its own time-limited encryption keys deterministically from this base key using a unique identifier and timestamp. This parameter change reduces storage overhead from O(n) keys for n clients to O(1) base key storage, while maintaining authentication accuracy through the deterministic key generation process.
4Reliability
If HTTPS protocol is used for secure communication, then encryption security is improved, but internet connectivity and processing functionality are required
Solution Approach 1:
The patent performs preliminary action by pre-distributing the base key to control units during manufacturing or initial setup, and pre-establishing the deterministic key generation algorithm. This allows control units to generate valid encryption keys and communicate securely without requiring real-time internet connectivity or processing functionality for key management. The security is established in advance, enabling offline operation while maintaining encryption security.
Data Source
AI summary
A computer-implemented method for generating and transmitting a Command data packet including Command data having a plurality of attributes associated therewith. A user control device receives a time-limited encryption key generated using a base key selected according to a specific one or more of the attributes. The user control device also receives a Checksum value representative of at least the specific one or more attributes. The Command data is encrypted using the time-limited encryption key, and a Command data packet is constructed having a plain value header and an encrypted Command Payload that includes at least the encrypted Command Data. The plain value header includes data representative of Checksum value and the subset of the plurality of attributes of the Command data except the specific one or more attributes used by the key issuing platform to select the base key.