IoT Token Authentication via Server Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices are insecure when accessing user data, particularly due to lack of secure data processing and storage capabilities, making them vulnerable to attackers who can copy and reuse tokens, leading to unauthorized access across multiple devices.
Innovation Solution
Implementing a server-based system that issues different types of tokens to IoT devices, with provisioning devices like smartphones authenticating and generating unique tokens for specific functions, allowing secure and controlled access while preventing unauthorized use by ensuring tokens are unique to each device and revocable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If tokens are issued to IoT devices for authentication and function access, then device authentication and function control are enabled, but tokens can be copied and reused on other devices leading to security vulnerabilities
Solution Approach 1:
The patent segments the authentication system into multiple components: provisioning devices (like smartphones) that hold master credentials, IoT devices that receive limited tokens, and a server that manages token issuance and revocation. This segmentation prevents token copying because each component has a specific role and the provisioning device never shares its master credentials with IoT devices.
Solution Approach 2:
The patent introduces a server as an intermediary between provisioning devices and IoT devices. The server acts as a trusted mediator that issues unique tokens to IoT devices based on authentication from provisioning devices. This intermediary prevents direct token sharing and enables centralized control over token lifecycle including revocation.
2Ease of operation
If the same token is reused across multiple devices for simplicity, then deployment is easier, but revocation becomes problematic as all devices lose access when the token is revoked
Solution Approach 1:
The patent creates a one-to-one mapping between tokens and devices through segmented token issuance. Each IoT device receives a unique token tied to its specific identity and capabilities. This segmentation enables precise control where tokens can be individually revoked from specific devices without affecting other devices, while still maintaining simple deployment through automated token provisioning.
Solution Approach 2:
The patent implements dynamic token management where tokens can be issued, modified, and revoked independently for each device. The server maintains dynamic control over token lifecycle, allowing tokens to be revoked from specific devices when needed while automatically managing reissuance. This dynamic approach provides both ease of deployment and flexible revocation control.
3Adaptability or versatility
If IoT devices are given full access to user data and functions, then device functionality is maximized, but security risks increase due to limited processing and storage capabilities
Solution Approach 1:
The patent applies local quality by issuing different types of tokens with different permission levels to different IoT devices based on their specific capabilities and security requirements. Each token is customized to grant only the necessary functions and data access levels for that specific device, rather than providing universal access. This enables maximized functionality for each device while maintaining security through differentiated access control.
Solution Approach 2:
The server acts as an intermediary that enforces security policies between IoT devices and user data. Instead of relying on IoT devices to implement their own security (which they cannot do effectively due to limited capabilities), the server mediates all access requests, validates tokens, and enforces permission boundaries. This allows IoT devices to have full functionality while the server ensures data security.
Data Source
AI summary
The disclosure is directed to security management in communications involving computing devices, e.g. Internet of Things (IoT) devices. An IoT device can perform various activities, e.g., social networking activities, for or on behalf of a user. An IoT device is typically insecure, especially when accessing user data. To control the type of activities that can be performed by various types of devices, a server device (“server”) can issue different types of tokens to different IoT devices. Which token an IoT device has determines the types of activities the IoT device can perform. For example, the server can issue a restricted token, which restricts the type of activities an IoT device can perform, and an unrestricted token to a more secure device, e.g., a smartphone, that can perform a broader range of activities. For example, the restrictive token may not permit the IoT device to change the password of a user.