Secure Transport Session Resumption for Constrained IoT Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Constrained devices, such as IoT devices, face battery life issues due to the computationally intensive operations required for establishing and maintaining secure transport sessions, as they often lack sufficient memory resources to store session state data and perform abbreviated handshake procedures.
Innovation Solution
The method allows constrained devices to resume previously-established secure transport sessions without performing full handshake procedures, by storing and retrieving an encrypted client session state from a server, enabling them to avoid energy-intensive operations and memory constraints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If constrained devices perform full handshake procedures to establish secure transport sessions, then security is maintained, but battery life is reduced due to computationally intensive operations
Solution Approach 1:
The server performs and stores the session state data (including encrypted pre-master secrets and session parameters) before the constrained device needs to resume the session. This preliminary action allows the device to skip computationally intensive handshake operations and simply retrieve and decrypt the pre-computed session state, thereby maintaining security while reducing energy consumption.
Solution Approach 2:
The server acts as an intermediary that holds and manages the session state data on behalf of the constrained device. Instead of the device performing all cryptographic operations, the server prepares and stores the encrypted session state, which the device can later retrieve and use to resume sessions without full handshakes, thus reducing the device's computational burden and energy usage.
2Duration of action of moving object
If constrained devices store session state data locally, then session resumption is enabled, but memory resources are insufficient
Solution Approach 1:
The server serves as an external memory intermediary, storing the session state data that would otherwise need to be kept in the constrained device's limited local memory. The device can store only minimal identifiers and retrieve the full encrypted session state from the server when needed, enabling session resumption without consuming scarce local memory resources.
Solution Approach 2:
The solution moves the storage dimension from local device memory to remote server storage. By transitioning the session state data from a local resource constraint to a remote accessible resource, the system enables session resumption capability without being limited by the device's memory quantity.
3Reliability
If constrained devices perform full handshake procedures frequently, then new secure sessions are established, but network traffic increases
Solution Approach 1:
Instead of performing complete full handshake procedures for every session establishment, the device performs a partial resumption procedure that retrieves and decrypts pre-computed session state data from the server. This partial action (skipping the cryptographic-intensive parts of the handshake) maintains security while significantly reducing network traffic compared to frequent full handshakes.
Data Source
AI summary
A constrained device, such as an Internet of Things (IoT) device, can use a handshake procedure to establish a secure transport session with a server and generate a corresponding client session state. The constrained device can encrypt the client session state into an encrypted client session state, and transmit the encrypted client session state to the server. When the constrained device enters an idle mode, the client session state may be cleared from memory of the constrained device. However, when the constrained device next wakes from the idle mode and re-enters an active mode, the constrained device can retrieve the encrypted client session state from the server. The constrained device can decrypt the encrypted client session state to recover the client session state, and use the recovered client session state to resume the secure transport session instead of establishing a new secure transport session with a new client session state.