IoT Device Network Joining via Token-Based Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT device authorization processes are time-consuming and complex, especially in systems with lower security requirements, where a more convenient and efficient method is needed for managing constrained devices joining a network.
Innovation Solution
A method involving a management node that generates an authentication parameter from a device-specific parameter and a token using a cryptographic function, allowing devices to join a network if the parameter meets a validity criterion, simplifying configuration by using a token as a solution to a cryptographic puzzle.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional public key authorization process is used, then security level is improved, but configuration time and complexity increase
Solution Approach 1:
The management node pre-generates and stores authorization parameters (public keys or tokens) before devices need to join the network. When a device requests to join, the node simply retrieves the pre-stored parameter and verifies it against the device identifier, eliminating the need for time-consuming real-time authorization computations.
Solution Approach 2:
Instead of using complex cryptographic operations during authorization, the system creates simplified copies of authorization data (authorization parameters) that can be quickly retrieved and verified. The management node stores copies of public keys or tokens associated with device identifiers, allowing rapid verification without re-computing cryptographic proofs.
2Reliability
If traditional public key authorization process is used, then security level is improved, but device complexity increases
Solution Approach 1:
The complex cryptographic authorization logic is extracted from the device and placed in the management node. Devices only need to store simple device identifiers and receive authorization parameters from the management node, while the management node handles all complex cryptographic verification and storage operations.
Solution Approach 2:
The management node serves multiple functions: it stores device identifiers, maintains authorization parameters, verifies device credentials, and manages the authorization process. This centralized multi-functional approach simplifies devices while consolidating complexity in the management node.
3Ease of operation
If simplified authorization process is used, then configuration ease is improved, but security level decreases
Solution Approach 1:
The management node acts as an intermediary that handles security-critical operations. It receives simple device identifiers from devices, retrieves pre-stored authorization parameters, verifies credentials securely, and issues authorization decisions. This intermediary approach allows simplified device operations while maintaining strong security through centralized verification.
Solution Approach 2:
Authorization parameters are pre-generated and stored in the management node before devices join. This preliminary action allows devices to use simple, easy-to-configure authorization mechanisms (just providing device identifiers and receiving pre-stored parameters) while the management node maintains strong security through its pre-computed and verified authorization data.
Data Source
AI summary
A method by a management node for managing a device operable to join a network includes receiving from the device a request to join the network, the request including a device specific parameter and a token, and generating an authentication parameter from the device specific parameters and the token. The method further includes authorising the device to join the network if the authentication parameter fulfils a validity criterion. Generating an authentication parameter from the device specific parameters and the token includes generating an input including the device specific parameters and the token, computing a cryptographic function of the generated input, and setting an output of the cryptographic function as the authentication parameter. Also disclosed are a method for operating a device, a management node, a device and a computer program.