IoT Sensitive-Data Storage with Network-Derived Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices are vulnerable to cyber-attacks due to the storage of sensitive data without adequate encryption, and existing solutions rely on user-provided passwords or keys, which are inefficient and insecure.
Innovation Solution
IoT devices derive a secret key from network environment attributes to encrypt and decrypt data without user involvement, ensuring secure storage and transmission of sensitive information only when network conditions allow, and prompt users when conditions are inadequate.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If sensitive data is stored without encryption to improve ease of operation, then user convenience is improved, but security is worsened making devices vulnerable to cyber-attacks
Solution Approach 1:
The system performs self-service by automatically deriving encryption keys from network environment attributes without requiring user intervention. The IoT device autonomously collects network attributes, generates cryptographic keys, and encrypts sensitive data, eliminating the need for users to manually manage encryption while maintaining security.
Solution Approach 2:
The system performs preliminary action by pre-deriving encryption keys from network environment attributes before data storage occurs. The key derivation process is executed in advance during device initialization or network connection establishment, so that when sensitive data needs to be stored, encryption is already prepared and immediately available.
2Reliability
If user-provided passwords or keys are used to protect data, then security is improved, but device complexity and user burden increase
Solution Approach 1:
The system eliminates the need for users to provide or manage passwords and keys by performing self-service key derivation. The IoT device automatically generates cryptographic keys from its network environment attributes, completely removing user burden related to key management while maintaining strong security.
Solution Approach 2:
The network environment attributes serve as an intermediary between the device and cryptographic key generation. Instead of users directly providing keys, the system uses observable network characteristics (SSID, BSSID, IP address) as intermediate data to derive keys, creating a seamless bridge that eliminates user involvement in key management.
3Reliability
If encryption is always required to improve security, then protection is improved, but user convenience deteriorates requiring constant interaction
Solution Approach 1:
The system automates the entire encryption process through self-service, deriving keys and encrypting data without requiring user interaction. The IoT device independently manages key derivation from network attributes and applies encryption to sensitive data, making the process transparent to users while ensuring continuous protection.
4Reliability
If conventional encryption methods are used to protect data, then security is improved, but processing speed and efficiency decrease
Solution Approach 1:
The system performs key derivation in advance during device initialization or network connection establishment, so that when data encryption is needed, the cryptographic keys are already prepared. This preliminary action eliminates runtime key generation overhead, significantly improving processing speed while maintaining security.
Data Source
AI summary
Protecting sensitive data in an internet-of-things (IoT) device. In one embodiment, a computing device includes network communications, a memory, and an electronic processor communicatively coupled to the memory and the network communications. The electronic processor is configured to receive a transaction setup request, determine, with the network communications, whether minimally required network environment attributes are available, prompt a user that sensitive data can be securely stored in the memory and to enter the sensitive data in response to determining that the minimally required network environment attributes are available, and prompt the user that the sensitive data cannot be securely stored in the memory in response to determining that the minimally required network environment attributes are not available.