IoT Session Key Generation Using Time-Based One-Time Passwords
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for encrypting sensor data in IoT devices are burdensome and require additional hardware, increasing processing time and resource consumption, especially in low-power environments where time is a factor and asymmetric key exchanges are not feasible.
Innovation Solution
A framework for fast and dynamic creation of session keys using shared time-based one-time password (TOTP) logic, where a provisioning server generates seed values for IoT devices to create identical session keys for encryption and decryption, avoiding the need for additional processors or memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric key exchanges are used for encrypting sensor data in IoT devices, then security is improved, but processing time and resource consumption increase
Solution Approach 1:
The encryption process is segmented into two distinct phases: (1) Asymmetric key exchange during initial provisioning to establish shared secret material, and (2) Symmetric encryption using derived session keys for actual sensor data transmission. This segmentation allows the computationally intensive asymmetric operations to occur only once during setup, while subsequent communications use efficient symmetric encryption, thereby maintaining security without excessive processing time for ongoing operations.
Solution Approach 2:
Session keys are pre-derived from the shared secret material established during the initial asymmetric key exchange. The provisioning server pre-computes multiple session keys and stores them securely, so that during actual data transmission, devices can quickly retrieve and use pre-computed keys rather than performing complex key derivation operations in real-time, significantly reducing processing time for encryption operations.
2Reliability
If additional hardware components are added to IoT devices for encryption, then security is improved, but device complexity and cost increase
Solution Approach 1:
The same cryptographic module in IoT devices is made multi-functional by implementing both asymmetric encryption (for initial key exchange) and symmetric encryption (for data transmission) capabilities within a single hardware component. This universal approach eliminates the need for separate dedicated hardware components for different encryption types, reducing device complexity while maintaining robust security through multiple encryption mechanisms.
3Productivity
If session keys are cached in memory for reuse, then processing speed is improved, but security is compromised due to replay attacks
Solution Approach 1:
Session keys are designed with built-in temporal validity periods and are periodically rotated. Each session key is associated with a specific time window or sequence number, and the system automatically invalidates keys after their designated lifespan expires. This periodic key rotation maintains security by preventing replay attacks while preserving processing speed through the use of pre-computed keys within their valid timeframes.
Solution Approach 2:
The provisioning server implements a feedback mechanism that tracks which session keys have been used and validates key freshness during authentication. When a device presents a cached session key, the server verifies its validity period and usage status before accepting it for decryption, providing real-time feedback that prevents replay attacks while allowing legitimate cached keys to be reused within their validity window.
Data Source
AI summary
A system for a time-based one-time password security system operating at a provisioning server may comprise transmitting one or more first locally generated random-string numbers for generation of a first time-based one-time password to a remotely connected internet of things sensor and a remotely connected internet of things sensor hub. The system may also comprise executing code instructions to associate the internet of things sensor with a first client key in a table stored in a memory operatively connected to the processor, associate the internet of things sensor hub with a second client key in the table, and associate the internet of things sensor and internet of things sensor hub with the one or more first locally generated random-string numbers in the table. Further the first remotely generated random-string numbers may identify a first preset function for generation of a first session key used in encrypting and decrypting sensor data records.