Uncloneable IoT Device Registration via Encrypted Private Identifier Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices face security risks due to open association methods that allow MAC address cloning, compromising network and data security, as existing registration processes do not ensure secure and uncloneable registration to wireless local area networks.
Innovation Solution
A method involving a remote association server that maintains secret public and private device identifiers as key:value pairs, where IoT devices send registration requests with their public identifier, receive an encrypted acknowledgement containing the private identifier, and only associate with the network if the identifiers match, preventing unauthorized cloning and association.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If open association method is used for IoT device registration, then ease of operation is improved, but network security deteriorates due to MAC address cloning vulnerability
Solution Approach 1:
The patent introduces an association server as an intermediary between the IoT device and the wireless network. The server verifies device authenticity by comparing the public identifier in the registration request with the corresponding private identifier from its database before granting network access, thereby preventing MAC address cloning attacks while maintaining ease of device registration.
2Ease of operation
If MAC address is used for device identification, then ease of operation is improved, but device security deteriorates due to cloneability
Solution Approach 1:
The patent segments the device identification system into two distinct parts: a public identifier (such as MAC address) that can be openly transmitted for identification purposes, and a private identifier that remains secret and is stored securely in the association server's database. This segmentation allows public identification while protecting against cloning by requiring server verification of the private identifier.
3Reliability
If encrypted registration acknowledgement with private identifier verification is implemented, then network security is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service authentication where the association server automatically performs the verification of the public identifier against the private identifier in its database, and sends back an encrypted acknowledgement. The IoT device simply needs to decrypt and verify the response, significantly reducing the complexity burden on the device while maintaining high security through server-side verification.
Data Source
AI summary
An IoT device has a public device identifier and a private device identifier, where the public device identifier is publicly available and the private device identifier is secret but kept in a secure device database as a correspondence. A registration request is sent from the IoT device to an association server in communication with the device database having an association between IoT public identifier and a corresponding IoT private identifier. The association server which receives the registration request responds with a registration acknowledgement containing, in encrypted form, the private device identifier of the original request and, optionally, the public device identifier associated with the registration request. The requesting IoT device receives the association acknowledgement, decrypts the private device identifier, compares it to its own device identifier, and if they match, sends one or more association requests.