Continuous Authentication for IoT Devices Using Time-Bound Shares
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices face challenges in secure authentication due to limited memory and processing capacity, making them vulnerable to attacks like Man-in-the-Middle, Eavesdropping, Denial of Service, and Replay attacks, and existing solutions do not provide continuous authentication efficiently.
Innovation Solution
A system and method for continuous authentication in IoT devices using a secret sharing scheme and time-bound shares, where a claimer generates time-bound shares from a secret key and combines them with a message payload, timestamp, and authenticator to create a secure transmission channel, allowing efficient authentication without the need for costly public key cryptography operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication mechanisms are used in IoT devices, then security is improved, but computational overhead and energy consumption increase significantly
Solution Approach 1:
The patent segments the authentication process into distinct phases: initial authentication using public key cryptography, and subsequent continuous authentication using lightweight symmetric operations. The secret key is divided into shares distributed to different parties, enabling efficient incremental authentication without requiring full public key operations each time.
Solution Approach 2:
The patent changes the cryptographic parameters used at different stages: initially using asymmetric cryptography (RSA/ECC) for key exchange, then switching to symmetric cryptography (HMAC, hash functions) for continuous authentication. This parameter change reduces computational complexity from O(log²n) to O(n) where n is the key length.
2Reliability
If public key cryptography is used for authentication, then message source authentication is improved, but computational complexity increases
Solution Approach 1:
The patent performs preliminary public key authentication to establish shared secret keys and secret shares before the actual message transmission. This preliminary action enables subsequent messages to be authenticated using lightweight symmetric operations rather than computationally expensive public key cryptography.
Solution Approach 2:
The patent introduces secret shares as an intermediary mechanism that bridges the security of public key cryptography with the efficiency of symmetric cryptography. The secret shares enable incremental authentication without requiring full public key operations while maintaining security through the underlying cryptographic relationships.
3Reliability
If frequent authentication is performed for continuous message transmission, then security is improved, but communication overhead increases
Solution Approach 1:
The patent establishes continuous authentication by enabling rapid incremental verification using pre-shared secrets and time-bound shares. Instead of performing full authentication handshakes for each message, the system maintains continuous security through efficient symmetric operations that can be executed frequently with minimal overhead.
Solution Approach 2:
The patent implements periodic refreshment of secret shares at predetermined intervals during the communication session. This periodic action maintains security by limiting the exposure window of any single secret share while allowing efficient authentication between refreshes, balancing security requirements with communication efficiency.
Data Source
AI summary
A system for continuous authentication of internet of things (IoT) devices in a communication network utilizes lightweight authentication for a sequence of message transmissions in a specific time-frame. A claimer device and a verifier device are in communication with the network. The claimer is configured to define a time frame and a time flag for an authentication session for a predetermined maximum number of messages, generate a time-bound share from a secret key, calculate a share authenticator for the share, combine a claimer identity (ID), a verifier ID, a message payload, the share, the share authenticator, a time flag, a timestamp, and message authenticator into a message, and send the message to the verifier within the time period. The verifier is configured to receive the message from the claimer, verify the message freshness, verify authenticity of the time flag and timestamp, and reveal and check the authenticity of the share.