IoT Trust Broker Authentication via Edge Gateway
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current messaging protocols for IoT architectures are weak from a security perspective and poorly suited for resource-constrained devices, particularly in terms of authentication and key establishment, especially for long-lasting deployments in remote areas.
Innovation Solution
An IoT system is introduced that includes a trust broker node and an edge gateway node, which collaborates to establish secure authentication and key agreement, using a proxy rule to route messages through a trust broker node, enabling efficient authentication and secure communication without a significant computational burden on devices or infrastructure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If basic MQTT security (identifier/password authentication) is used, then device connection is simple and resource consumption is low, but security is weak and insufficient for protecting against spoofed connections
Solution Approach 1:
The patent introduces a trust broker as an intermediary component that mediates authentication between IoT devices and the network. The trust broker verifies device identities and manages authentication credentials, allowing simple identifier/password authentication at the device level while centralizing complex security verification at the broker level. This resolves the contradiction by maintaining low device complexity while improving overall system security through the intermediary trust broker.
Solution Approach 2:
The authentication system is segmented into multiple components: device-level simple authentication, broker-level verification, and optional TLS encryption. This segmentation allows each component to handle specific security tasks with appropriate complexity, enabling strong overall security without requiring every device to implement complex cryptographic protocols locally.
2Reliability
If TLS with X.509 certificates is used for device authentication, then security is improved, but computational burden and resource consumption increase significantly
Solution Approach 1:
Authentication credentials and trust relationships are established in advance during device provisioning and registration with the trust broker. This preliminary action allows devices to use simple identifier/password pairs for ongoing communications rather than performing computationally intensive certificate verification for each message exchange, significantly reducing energy consumption while maintaining security through pre-established trust.
Solution Approach 2:
The system uses lightweight, disposable authentication tokens and session keys that are generated and validated efficiently by the broker rather than requiring devices to maintain and process heavy cryptographic certificates continuously. This approach provides strong security through frequent re-authentication with minimal computational overhead on resource-constrained devices.
3Reliability
If application layer encryption is implemented, then confidentiality protection is improved, but device complexity and processing requirements increase
Solution Approach 1:
The trust broker acts as an intermediary that manages encryption key distribution and application layer encryption/decryption operations. Devices can use simple symmetric encryption with keys managed by the broker, avoiding the need to implement complex asymmetric encryption and key management protocols locally, thus achieving confidentiality with minimal device complexity.
4Adaptability or versatility
If loose connection through gateway is used, then device deployment flexibility is improved, but connection reliability and security are reduced
Solution Approach 1:
The trust broker implements continuous monitoring and verification of device connections, providing feedback mechanisms that detect and respond to connection anomalies, unauthorized access attempts, and security threats. This feedback loop maintains connection reliability and security even with loose gateway connections by actively managing and verifying the authentication state of each device throughout its operational lifecycle.
Data Source
AI summary
It is recognized herein that current messaging protocols for internet of things (IoT) architectures are often weak from a security perspective, and are often poorly suited for resource-constrained devices. An example IoT system described herein combines device authentication and application-layer key establishment using facilities of IoT messaging protocols. The IoT system may include a Trust Broker, which acts as a registration point for devices, and an edge gateway, which manages communication between a given device and the trust broker (and IoT servers). The edge gateway may acquire a trusted role, such that it may be a secure intermediary for device-server messaging, and such that it can facilitate authentication of devices to services.